@agentronics/sdk 0.1.2 → 0.3.0

package/dist/index.js

@@ -1,2 +1,2 @@
-import {f,d,P}from'./chunk-VWQY7QIL.js';export{E as DEFAULT_GROUP,w as WELL_KNOWN_PATH,b as bundledDetectors,k as createAgentContextStore,j as createAuthEngine,M as createConsoleExporter,c as createDetectorRegistry,N as createGatewayExporter,g as createIdentityStore,s as createMemoryCache,q as createMemoryStore,n as createPolicyCache,m as createPolicyEngine,A as createProgressionStore,l as createRateLimiter,e as createSignatureLoader,r as createSiteMemoryStore,z as createToolRegistry,K as createTraceBuffer,L as createTracer,J as createWebMcpAdapter,t as createWebMcpContextTool,O as createWebhookExporter,B as decideSurfacing,d as declareAgent,h as deriveTrustLevel,f as detectAgent,a as detectDom,I as estimateBudget,H as estimateToolTokens,D as explainSurfacing,x as fetchWellKnownContext,F as groupTools,i as highestTrust,P as init,p as installDomEnforcer,v as installMemoryOverlay,u as installMetaTags,G as listGroupNames,y as serializeWellKnownContext,o as showDenyOverlay,C as surfaceTools}from'./chunk-VWQY7QIL.js';export{a as detectWebMcp}from'./chunk-5BS4OAQA.js';var me={init:P,declareAgent:d,detectAgent:f},ge="0.1.0";export{me as Agentronics,ge as VERSION};//# sourceMappingURL=index.js.map
+import {h,f,R}from'./chunk-4FJRAPA6.js';export{a as CRAWLER_SIGNATURES,G as DEFAULT_GROUP,y as WELL_KNOWN_PATH,d as bundledDetectors,m as createAgentContextStore,l as createAuthEngine,O as createConsoleExporter,e as createDetectorRegistry,P as createGatewayExporter,i as createIdentityStore,u as createMemoryCache,s as createMemoryStore,p as createPolicyCache,o as createPolicyEngine,C as createProgressionStore,n as createRateLimiter,g as createSignatureLoader,t as createSiteMemoryStore,B as createToolRegistry,M as createTraceBuffer,N as createTracer,L as createWebMcpAdapter,v as createWebMcpContextTool,Q as createWebhookExporter,D as decideSurfacing,f as declareAgent,j as deriveTrustLevel,h as detectAgent,b as detectCrawler,c as detectDom,K as estimateBudget,J as estimateToolTokens,F as explainSurfacing,z as fetchWellKnownContext,H as groupTools,k as highestTrust,R as init,r as installDomEnforcer,x as installMemoryOverlay,w as installMetaTags,I as listGroupNames,A as serializeWellKnownContext,q as showDenyOverlay,E as surfaceTools}from'./chunk-4FJRAPA6.js';export{b as detectWebMcp}from'./chunk-LLD3Y2LZ.js';var le={init:R,declareAgent:f,detectAgent:h},Se="0.1.0";export{le as Agentronics,Se as VERSION};//# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["Agentronics","init","declareAgent","detectAgent","VERSION"],"mappings":"ujCAmMO,IAAMA,EAAAA,CAAc,CAAE,IAAA,CAAAC,CAAAA,CAAM,aAAAC,CAAAA,CAAc,WAAA,CAAAC,CAAY,CAAA,CAEhDC,EAAAA,CAAU","file":"index.js","sourcesContent":["import { init, type AgentronicsClient, type InitOptions } from './init.js'\nimport {\n  declareAgent,\n  bundledDetectors,\n  createDetectorRegistry,\n  createSignatureLoader,\n  detectAgent,\n  detectDom,\n  detectWebMcp,\n  type DeclareAgentInput,\n  type DetectAgentOptions,\n  type DetectDomOptions,\n  type DetectWebMcpOptions,\n  type Detector,\n  type DetectorRegistry,\n  type DetectorStatus,\n  type DomSignalName,\n} from './detection/index.js'\nimport {\n  createIdentityStore,\n  type IdentityStore,\n  type PresentIdentityOptions,\n  type PresentedIdentity,\n} from './auth/identity.js'\nimport { createAuthEngine, type AuthEngine, type AuthInput, type AuthMethod } from './auth/engine.js'\nimport {\n  createAgentContextStore,\n  type AgentContextStore,\n  type AgentContextSnapshot,\n  type AgentContextListener,\n} from './auth/agentContext.js'\nimport { deriveTrustLevel, highestTrust } from './auth/trustLevel.js'\nimport { createPolicyEngine, type PolicyEngine } from './authz/engine.js'\nimport { createRateLimiter, type RateLimiter } from './authz/rateLimiter.js'\nimport { createPolicyCache, type PolicyCache } from './authz/policyCache.js'\nimport { installDomEnforcer } from './authz/domEnforcer.js'\nimport { showDenyOverlay } from './authz/overlay.js'\nimport { createMemoryStore, type MemoryStore } from './memory/store.js'\nimport {\n  createSiteMemoryStore,\n  type SiteMemoryStore,\n  type SiteMemoryListener,\n  type ProvideForPageInput,\n} from './memory/siteMemory.js'\nimport { createMemoryCache, type MemoryCache } from './memory/memoryCache.js'\nimport {\n  createWebMcpContextTool,\n  installMetaTags,\n  installMemoryOverlay,\n  fetchWellKnownContext,\n  serializeWellKnownContext,\n  WELL_KNOWN_PATH,\n  type WebMcpContextTool,\n  type WebMcpContextOptions,\n} from './memory/delivery/index.js'\nimport { createToolRegistry, type GovernedTool, type ToolRegistry } from './tools/registry.js'\nimport {\n  decideSurfacing,\n  surfaceTools,\n  explainSurfacing,\n  type SurfacingContext,\n  type SurfacingDecision,\n} from './tools/surfacing.js'\nimport {\n  groupTools,\n  listGroupNames,\n  DEFAULT_GROUP,\n  type ToolGroupSummary,\n} from './tools/groups.js'\nimport {\n  createProgressionStore,\n  type ProgressionConfig,\n  type ProgressionStage,\n  type ProgressionStore,\n  type ProgressionTransition,\n} from './tools/progression.js'\nimport {\n  estimateBudget,\n  estimateToolTokens,\n  type ToolTokenEstimate,\n  type TokenBudgetReport,\n} from './tools/tokenEstimate.js'\nimport {\n  createWebMcpAdapter,\n  type WebMcpAdapter,\n  type WebMcpAdapterOptions,\n  type WebMcpToolDescriptor,\n  type WebMcpProvider,\n} from './tools/webmcpAdapter.js'\nimport {\n  createTracer,\n  createTraceBuffer,\n  createConsoleExporter,\n  createGatewayExporter,\n  createWebhookExporter,\n  type TraceExporter,\n  type TraceInput,\n  type Tracer,\n} from './observability/index.js'\n\nexport {\n  init,\n  declareAgent,\n  detectAgent,\n  detectDom,\n  detectWebMcp,\n  createDetectorRegistry,\n  bundledDetectors,\n  createSignatureLoader,\n  createIdentityStore,\n  createAuthEngine,\n  createAgentContextStore,\n  deriveTrustLevel,\n  highestTrust,\n  createPolicyEngine,\n  createRateLimiter,\n  createPolicyCache,\n  installDomEnforcer,\n  showDenyOverlay,\n  createToolRegistry,\n  decideSurfacing,\n  surfaceTools,\n  explainSurfacing,\n  groupTools,\n  listGroupNames,\n  DEFAULT_GROUP,\n  createProgressionStore,\n  estimateBudget,\n  estimateToolTokens,\n  createWebMcpAdapter,\n  createMemoryStore,\n  createSiteMemoryStore,\n  createMemoryCache,\n  createWebMcpContextTool,\n  installMetaTags,\n  installMemoryOverlay,\n  fetchWellKnownContext,\n  serializeWellKnownContext,\n  WELL_KNOWN_PATH,\n  createTracer,\n  createTraceBuffer,\n  createConsoleExporter,\n  createGatewayExporter,\n  createWebhookExporter,\n}\nexport type {\n  AgentronicsClient,\n  AuthEngine,\n  AuthInput,\n  AuthMethod,\n  AgentContextStore,\n  AgentContextSnapshot,\n  AgentContextListener,\n  DeclareAgentInput,\n  DetectAgentOptions,\n  DetectDomOptions,\n  DetectWebMcpOptions,\n  DomSignalName,\n  IdentityStore,\n  InitOptions,\n  MemoryStore,\n  SiteMemoryStore,\n  SiteMemoryListener,\n  MemoryCache,\n  ProvideForPageInput,\n  WebMcpContextTool,\n  WebMcpContextOptions,\n  GovernedTool,\n  ToolRegistry,\n  SurfacingContext,\n  SurfacingDecision,\n  ToolGroupSummary,\n  ProgressionConfig,\n  ProgressionStage,\n  ProgressionStore,\n  ProgressionTransition,\n  ToolTokenEstimate,\n  TokenBudgetReport,\n  WebMcpAdapter,\n  WebMcpAdapterOptions,\n  WebMcpToolDescriptor,\n  WebMcpProvider,\n  PolicyEngine,\n  PolicyCache,\n  RateLimiter,\n  Detector,\n  DetectorRegistry,\n  DetectorStatus,\n  PresentIdentityOptions,\n  PresentedIdentity,\n  TraceExporter,\n  TraceInput,\n  Tracer,\n}\n\nexport const Agentronics = { init, declareAgent, detectAgent }\n\nexport const VERSION = '0.1.0'\n"]}
+{"version":3,"sources":["../src/index.ts"],"names":["Agentronics","init","declareAgent","detectAgent","VERSION"],"mappings":"kmCA6MO,IAAMA,EAAAA,CAAc,CAAE,IAAA,CAAAC,CAAAA,CAAM,aAAAC,CAAAA,CAAc,WAAA,CAAAC,CAAY,CAAA,CAEhDC,EAAAA,CAAU","file":"index.js","sourcesContent":["import { init, type AgentronicsClient, type InitOptions } from './init.js'\nimport {\n  declareAgent,\n  bundledDetectors,\n  createDetectorRegistry,\n  createSignatureLoader,\n  detectAgent,\n  detectCrawler,\n  detectDom,\n  detectWebMcp,\n  CRAWLER_SIGNATURES,\n  type DeclareAgentInput,\n  type DetectAgentOptions,\n  type DetectCrawlerOptions,\n  type CrawlerSignature,\n  type CrawlerCategory,\n  type DetectDomOptions,\n  type DetectWebMcpOptions,\n  type Detector,\n  type DetectorRegistry,\n  type DetectorStatus,\n  type DomSignalName,\n} from './detection/index.js'\nimport {\n  createIdentityStore,\n  type IdentityStore,\n  type PresentIdentityOptions,\n  type PresentedIdentity,\n} from './auth/identity.js'\nimport { createAuthEngine, type AuthEngine, type AuthInput, type AuthMethod } from './auth/engine.js'\nimport {\n  createAgentContextStore,\n  type AgentContextStore,\n  type AgentContextSnapshot,\n  type AgentContextListener,\n} from './auth/agentContext.js'\nimport { deriveTrustLevel, highestTrust } from './auth/trustLevel.js'\nimport { createPolicyEngine, type PolicyEngine } from './authz/engine.js'\nimport { createRateLimiter, type RateLimiter } from './authz/rateLimiter.js'\nimport { createPolicyCache, type PolicyCache } from './authz/policyCache.js'\nimport { installDomEnforcer } from './authz/domEnforcer.js'\nimport { showDenyOverlay } from './authz/overlay.js'\nimport { createMemoryStore, type MemoryStore } from './memory/store.js'\nimport {\n  createSiteMemoryStore,\n  type SiteMemoryStore,\n  type SiteMemoryListener,\n  type ProvideForPageInput,\n} from './memory/siteMemory.js'\nimport { createMemoryCache, type MemoryCache } from './memory/memoryCache.js'\nimport {\n  createWebMcpContextTool,\n  installMetaTags,\n  installMemoryOverlay,\n  fetchWellKnownContext,\n  serializeWellKnownContext,\n  WELL_KNOWN_PATH,\n  type WebMcpContextTool,\n  type WebMcpContextOptions,\n} from './memory/delivery/index.js'\nimport { createToolRegistry, type GovernedTool, type ToolRegistry } from './tools/registry.js'\nimport {\n  decideSurfacing,\n  surfaceTools,\n  explainSurfacing,\n  type SurfacingContext,\n  type SurfacingDecision,\n} from './tools/surfacing.js'\nimport {\n  groupTools,\n  listGroupNames,\n  DEFAULT_GROUP,\n  type ToolGroupSummary,\n} from './tools/groups.js'\nimport {\n  createProgressionStore,\n  type ProgressionConfig,\n  type ProgressionStage,\n  type ProgressionStore,\n  type ProgressionTransition,\n} from './tools/progression.js'\nimport {\n  estimateBudget,\n  estimateToolTokens,\n  type ToolTokenEstimate,\n  type TokenBudgetReport,\n} from './tools/tokenEstimate.js'\nimport {\n  createWebMcpAdapter,\n  type WebMcpAdapter,\n  type WebMcpAdapterOptions,\n  type WebMcpToolDescriptor,\n  type WebMcpProvider,\n} from './tools/webmcpAdapter.js'\nimport {\n  createTracer,\n  createTraceBuffer,\n  createConsoleExporter,\n  createGatewayExporter,\n  createWebhookExporter,\n  type TraceExporter,\n  type TraceInput,\n  type Tracer,\n} from './observability/index.js'\n\nexport {\n  init,\n  declareAgent,\n  detectAgent,\n  detectCrawler,\n  detectDom,\n  detectWebMcp,\n  CRAWLER_SIGNATURES,\n  createDetectorRegistry,\n  bundledDetectors,\n  createSignatureLoader,\n  createIdentityStore,\n  createAuthEngine,\n  createAgentContextStore,\n  deriveTrustLevel,\n  highestTrust,\n  createPolicyEngine,\n  createRateLimiter,\n  createPolicyCache,\n  installDomEnforcer,\n  showDenyOverlay,\n  createToolRegistry,\n  decideSurfacing,\n  surfaceTools,\n  explainSurfacing,\n  groupTools,\n  listGroupNames,\n  DEFAULT_GROUP,\n  createProgressionStore,\n  estimateBudget,\n  estimateToolTokens,\n  createWebMcpAdapter,\n  createMemoryStore,\n  createSiteMemoryStore,\n  createMemoryCache,\n  createWebMcpContextTool,\n  installMetaTags,\n  installMemoryOverlay,\n  fetchWellKnownContext,\n  serializeWellKnownContext,\n  WELL_KNOWN_PATH,\n  createTracer,\n  createTraceBuffer,\n  createConsoleExporter,\n  createGatewayExporter,\n  createWebhookExporter,\n}\nexport type {\n  AgentronicsClient,\n  AuthEngine,\n  AuthInput,\n  AuthMethod,\n  AgentContextStore,\n  AgentContextSnapshot,\n  AgentContextListener,\n  DeclareAgentInput,\n  DetectAgentOptions,\n  DetectCrawlerOptions,\n  CrawlerSignature,\n  CrawlerCategory,\n  DetectDomOptions,\n  DetectWebMcpOptions,\n  DomSignalName,\n  IdentityStore,\n  InitOptions,\n  MemoryStore,\n  SiteMemoryStore,\n  SiteMemoryListener,\n  MemoryCache,\n  ProvideForPageInput,\n  WebMcpContextTool,\n  WebMcpContextOptions,\n  GovernedTool,\n  ToolRegistry,\n  SurfacingContext,\n  SurfacingDecision,\n  ToolGroupSummary,\n  ProgressionConfig,\n  ProgressionStage,\n  ProgressionStore,\n  ProgressionTransition,\n  ToolTokenEstimate,\n  TokenBudgetReport,\n  WebMcpAdapter,\n  WebMcpAdapterOptions,\n  WebMcpToolDescriptor,\n  WebMcpProvider,\n  PolicyEngine,\n  PolicyCache,\n  RateLimiter,\n  Detector,\n  DetectorRegistry,\n  DetectorStatus,\n  PresentIdentityOptions,\n  PresentedIdentity,\n  TraceExporter,\n  TraceInput,\n  Tracer,\n}\n\nexport const Agentronics = { init, declareAgent, detectAgent }\n\nexport const VERSION = '0.1.0'\n"]}

package/dist/{init-only-CsMtI9lh.d.ts → init-only-7f8_LQAI.d.ts}

@@ -1,6 +1,42 @@
 import { AgentIdentity, IdentityClaim, TraceEvent, TraceEventType, VerificationResult, AgentClass, PolicyRule, PolicyEvaluation, MemoryScope, MemoryEntry, SiteMemory, SiteMemoryPageContext } from '@agentronics/protocol';
 import { D as DetectWebMcpOptions } from './webmcp-C4ikhM4g.js';
 
+type CrawlerCategory = 'ai' | 'search';
+interface CrawlerSignature {
+    /** Stable vendor id, reported as identity.vendor. */
+    name: string;
+    category: CrawlerCategory;
+    /** Tested against navigator.userAgent. */
+    pattern: RegExp;
+}
+/**
+ * Known AI + search crawlers, matched by User-Agent token.
+ *
+ * Caveats baked into the design:
+ * - UA is self-reported and trivially spoofable, so a match is high-confidence
+ *   but never certain — we report `confidence: 0.9`, not `1`.
+ * - This is client-side detection: it only sees crawlers that actually execute
+ *   JavaScript on the page. The majority of crawlers fetch HTML and never run
+ *   the SDK, so full coverage needs server/edge UA inspection (a future product).
+ *
+ * Order matters: more specific tokens (e.g. `Google-Extended`, `Applebot-Extended`)
+ * are listed before their broader siblings so the first match wins correctly.
+ */
+declare const CRAWLER_SIGNATURES: CrawlerSignature[];
+interface DetectCrawlerOptions {
+    /** Override the signature table (e.g. to add private/first-party crawlers). */
+    signatures?: CrawlerSignature[];
+    /** Skip crawler detection entirely. */
+    disable?: boolean;
+    /** Confidence reported on a UA match. Default 0.9 (UA is spoofable). */
+    confidence?: number;
+}
+/**
+ * Identify known AI/search crawlers by their User-Agent token. Returns `null`
+ * when no signature matches or when there is no `navigator` (server-side).
+ */
+declare const detectCrawler: (options?: DetectCrawlerOptions) => AgentIdentity | null;
+
 interface SignalResult {
     hit: boolean;
     weight: number;
@@ -37,13 +73,15 @@ type DetectorRegistry = ReturnType<typeof createDetectorRegistry>;
 
 interface DetectAgentOptions {
     webmcp?: DetectWebMcpOptions | false;
+    crawler?: DetectCrawlerOptions | false;
     dom?: DetectDomOptions | false;
     customDetectors?: Detector[];
     experimental?: boolean;
 }
 /**
- * Run the full detection pipeline. WebMCP wins if present (exact match), then DOM heuristics.
- * Returns `null` if no agent class fires above its threshold — caller should treat as "human or
+ * Run the full detection pipeline. WebMCP wins if present (exact match), then a
+ * known-crawler User-Agent match, then DOM automation heuristics. Returns `null`
+ * if no agent class fires above its threshold — caller should treat as "human or
  * undetectable agent."
  */
 declare const detectAgent: (options?: DetectAgentOptions) => Promise<AgentIdentity | null>;
@@ -270,6 +308,7 @@ interface GovernedTool<Input = unknown, Output = unknown> {
     group?: string;
     description?: string;
     inputSchema?: Record<string, unknown>;
+    outputSchema?: Record<string, unknown>;
     stage?: string;
     authz?: Omit<PolicyRule, 'id' | 'tool'>;
     rateLimit?: PolicyRule['rateLimit'];
@@ -284,6 +323,18 @@ interface ToolRegistryOptions {
     setPolicies?: (rules: PolicyRule[]) => void;
     listPolicies?: () => PolicyRule[];
     onTrace?: (input: TraceInput) => void;
+    /**
+     * Resolves the ambient agent identity for `execute()` calls that don't pass
+     * one explicitly. The SDK wires this to the agentContext snapshot so a
+     * button-bound tool fires with the detected agent attached — without
+     * forcing every consumer to thread identity through their click handlers.
+     *
+     * Semantics:
+     * - `execute(name, input)` or `execute(name, input, undefined)` → resolver
+     * - `execute(name, input, null)` → respected (caller wants anonymous attribution)
+     * - `execute(name, input, identity)` → respected
+     */
+    identityResolver?: () => AgentIdentity | null;
 }
 interface ToolRegistry {
     register(tool: GovernedTool): () => void;
@@ -297,7 +348,7 @@ interface ToolRegistry {
     get(name: string): GovernedTool | undefined;
     execute<Input, Output>(name: string, input: Input, identity?: AgentIdentity | null): Promise<Output>;
 }
-declare const createToolRegistry: ({ evaluate, setPolicies, listPolicies, onTrace, }: ToolRegistryOptions) => ToolRegistry;
+declare const createToolRegistry: ({ evaluate, setPolicies, listPolicies, onTrace, identityResolver, }: ToolRegistryOptions) => ToolRegistry;
 
 interface ProgressionTransition {
     on: string;
@@ -425,6 +476,19 @@ interface InitOptions {
     auth?: AuthContext;
     progression?: ProgressionConfig;
     tools?: GovernedTool[];
+    /**
+     * Run agent detection automatically on init and keep the resulting
+     * identity in agentContext so every subsequent tools.execute() call gets
+     * attributed without the host page passing identity through. Default
+     * `true` — opt out with `false` for privacy-mode hosts, or pass
+     * DetectAgentOptions to tune the detectors (e.g. raise the DOM threshold).
+     *
+     * The first detection cycle runs synchronously where possible (DOM
+     * heuristics) and continues asynchronously for WebMCP polling, so very
+     * early click handlers may see identity=null for a single frame; the
+     * `ready` promise on the returned client resolves once the cycle finishes.
+     */
+    autoDetect?: boolean | DetectAgentOptions;
     trace?: {
         enabled?: boolean;
         bufferSize?: number;
@@ -452,6 +516,13 @@ interface AgentronicsClient {
     readonly tools: ToolRegistry;
     readonly progression: ProgressionStore | null;
     readonly webmcp: WebMcpAdapter;
+    /**
+     * Resolves once the initial autoDetect cycle finishes. Rejects only if the
+     * autoDetect configuration itself is invalid; detection failures resolve to
+     * `null` (treated as "human or undetectable agent"). When `autoDetect` was
+     * disabled the promise resolves immediately to `null`.
+     */
+    readonly ready: Promise<AgentIdentity | null>;
     detect(options?: DetectAgentOptions): Promise<AgentIdentity | null>;
     authenticate(input: AuthInput): Promise<AgentIdentity | null>;
     presentIdentity(input: PresentIdentityOptions): PresentedIdentity;
@@ -477,6 +548,9 @@ interface AgentronicsClient {
         uninstall: () => void;
     };
     registerTool(tool: GovernedTool): () => void;
+    /** Push the full tool registry to the gateway so the dashboard can render
+     *  the page-wise view (schemas, per-tool tokens, context fullness). */
+    syncTools(): Promise<number>;
     surfaceTools(options?: {
         identity?: AgentIdentity | null;
     }): GovernedTool[];
@@ -516,4 +590,4 @@ interface AgentronicsClient {
 }
 declare const init: (options: InitOptions) => AgentronicsClient;
 
-export { createProgressionStore as $, type AgentronicsClient as A, type ToolGroupSummary as B, type ToolRegistry as C, type DetectAgentOptions as D, type ToolTokenEstimate as E, type TraceInput as F, type GovernedTool as G, type Tracer as H, type InitOptions as I, type WebMcpAdapterOptions as J, type WebMcpProvider as K, type WebMcpToolDescriptor as L, type MemoryCache as M, bundledDetectors as N, createAgentContextStore as O, type PolicyEngine as P, createAuthEngine as Q, type RateLimiter as R, type SiteMemoryListener as S, type TraceExporter as T, createDetectorRegistry as U, createIdentityStore as V, type WebMcpAdapter as W, createMemoryCache as X, createMemoryStore as Y, createPolicyCache as Z, createPolicyEngine as _, type AgentContextListener as a, createRateLimiter as a0, createSiteMemoryStore as a1, createToolRegistry as a2, createTracer as a3, createWebMcpAdapter as a4, decideSurfacing as a5, detectAgent as a6, detectDom as a7, estimateBudget as a8, estimateToolTokens as a9, explainSurfacing as aa, groupTools as ab, init as ac, listGroupNames as ad, surfaceTools as ae, type AgentContextSnapshot as b, type AgentContextStore as c, type AuthEngine as d, type AuthInput as e, type AuthMethod as f, DEFAULT_GROUP as g, type DetectDomOptions as h, type Detector as i, type DetectorRegistry as j, type DetectorStatus as k, type DomSignalName as l, type IdentityStore as m, type MemoryStore as n, type PolicyCache as o, type PresentIdentityOptions as p, type PresentedIdentity as q, type ProgressionConfig as r, type ProgressionStage as s, type ProgressionStore as t, type ProgressionTransition as u, type ProvideForPageInput as v, type SiteMemoryStore as w, type SurfacingContext as x, type SurfacingDecision as y, type TokenBudgetReport as z };
+export { createMemoryCache as $, type AgentronicsClient as A, type SurfacingContext as B, CRAWLER_SIGNATURES as C, type DetectAgentOptions as D, type SurfacingDecision as E, type TokenBudgetReport as F, type GovernedTool as G, type ToolGroupSummary as H, type InitOptions as I, type ToolRegistry as J, type ToolTokenEstimate as K, type TraceInput as L, type MemoryCache as M, type Tracer as N, type WebMcpAdapterOptions as O, type PolicyEngine as P, type WebMcpProvider as Q, type RateLimiter as R, type SiteMemoryListener as S, type TraceExporter as T, type WebMcpToolDescriptor as U, bundledDetectors as V, type WebMcpAdapter as W, createAgentContextStore as X, createAuthEngine as Y, createDetectorRegistry as Z, createIdentityStore as _, type AgentContextListener as a, createMemoryStore as a0, createPolicyCache as a1, createPolicyEngine as a2, createProgressionStore as a3, createRateLimiter as a4, createSiteMemoryStore as a5, createToolRegistry as a6, createTracer as a7, createWebMcpAdapter as a8, decideSurfacing as a9, detectAgent as aa, detectCrawler as ab, detectDom as ac, estimateBudget as ad, estimateToolTokens as ae, explainSurfacing as af, groupTools as ag, init as ah, listGroupNames as ai, surfaceTools as aj, type AgentContextSnapshot as b, type AgentContextStore as c, type AuthEngine as d, type AuthInput as e, type AuthMethod as f, type CrawlerCategory as g, type CrawlerSignature as h, DEFAULT_GROUP as i, type DetectCrawlerOptions as j, type DetectDomOptions as k, type Detector as l, type DetectorRegistry as m, type DetectorStatus as n, type DomSignalName as o, type IdentityStore as p, type MemoryStore as q, type PolicyCache as r, type PresentIdentityOptions as s, type PresentedIdentity as t, type ProgressionConfig as u, type ProgressionStage as v, type ProgressionStore as w, type ProgressionTransition as x, type ProvideForPageInput as y, type SiteMemoryStore as z };

package/dist/{init-only-CH7e1rAO.d.cts → init-only-Cwll8MGz.d.cts}

@@ -1,6 +1,42 @@
 import { AgentIdentity, IdentityClaim, TraceEvent, TraceEventType, VerificationResult, AgentClass, PolicyRule, PolicyEvaluation, MemoryScope, MemoryEntry, SiteMemory, SiteMemoryPageContext } from '@agentronics/protocol';
 import { D as DetectWebMcpOptions } from './webmcp-C4ikhM4g.cjs';
 
+type CrawlerCategory = 'ai' | 'search';
+interface CrawlerSignature {
+    /** Stable vendor id, reported as identity.vendor. */
+    name: string;
+    category: CrawlerCategory;
+    /** Tested against navigator.userAgent. */
+    pattern: RegExp;
+}
+/**
+ * Known AI + search crawlers, matched by User-Agent token.
+ *
+ * Caveats baked into the design:
+ * - UA is self-reported and trivially spoofable, so a match is high-confidence
+ *   but never certain — we report `confidence: 0.9`, not `1`.
+ * - This is client-side detection: it only sees crawlers that actually execute
+ *   JavaScript on the page. The majority of crawlers fetch HTML and never run
+ *   the SDK, so full coverage needs server/edge UA inspection (a future product).
+ *
+ * Order matters: more specific tokens (e.g. `Google-Extended`, `Applebot-Extended`)
+ * are listed before their broader siblings so the first match wins correctly.
+ */
+declare const CRAWLER_SIGNATURES: CrawlerSignature[];
+interface DetectCrawlerOptions {
+    /** Override the signature table (e.g. to add private/first-party crawlers). */
+    signatures?: CrawlerSignature[];
+    /** Skip crawler detection entirely. */
+    disable?: boolean;
+    /** Confidence reported on a UA match. Default 0.9 (UA is spoofable). */
+    confidence?: number;
+}
+/**
+ * Identify known AI/search crawlers by their User-Agent token. Returns `null`
+ * when no signature matches or when there is no `navigator` (server-side).
+ */
+declare const detectCrawler: (options?: DetectCrawlerOptions) => AgentIdentity | null;
+
 interface SignalResult {
     hit: boolean;
     weight: number;
@@ -37,13 +73,15 @@ type DetectorRegistry = ReturnType<typeof createDetectorRegistry>;
 
 interface DetectAgentOptions {
     webmcp?: DetectWebMcpOptions | false;
+    crawler?: DetectCrawlerOptions | false;
     dom?: DetectDomOptions | false;
     customDetectors?: Detector[];
     experimental?: boolean;
 }
 /**
- * Run the full detection pipeline. WebMCP wins if present (exact match), then DOM heuristics.
- * Returns `null` if no agent class fires above its threshold — caller should treat as "human or
+ * Run the full detection pipeline. WebMCP wins if present (exact match), then a
+ * known-crawler User-Agent match, then DOM automation heuristics. Returns `null`
+ * if no agent class fires above its threshold — caller should treat as "human or
  * undetectable agent."
  */
 declare const detectAgent: (options?: DetectAgentOptions) => Promise<AgentIdentity | null>;
@@ -270,6 +308,7 @@ interface GovernedTool<Input = unknown, Output = unknown> {
     group?: string;
     description?: string;
     inputSchema?: Record<string, unknown>;
+    outputSchema?: Record<string, unknown>;
     stage?: string;
     authz?: Omit<PolicyRule, 'id' | 'tool'>;
     rateLimit?: PolicyRule['rateLimit'];
@@ -284,6 +323,18 @@ interface ToolRegistryOptions {
     setPolicies?: (rules: PolicyRule[]) => void;
     listPolicies?: () => PolicyRule[];
     onTrace?: (input: TraceInput) => void;
+    /**
+     * Resolves the ambient agent identity for `execute()` calls that don't pass
+     * one explicitly. The SDK wires this to the agentContext snapshot so a
+     * button-bound tool fires with the detected agent attached — without
+     * forcing every consumer to thread identity through their click handlers.
+     *
+     * Semantics:
+     * - `execute(name, input)` or `execute(name, input, undefined)` → resolver
+     * - `execute(name, input, null)` → respected (caller wants anonymous attribution)
+     * - `execute(name, input, identity)` → respected
+     */
+    identityResolver?: () => AgentIdentity | null;
 }
 interface ToolRegistry {
     register(tool: GovernedTool): () => void;
@@ -297,7 +348,7 @@ interface ToolRegistry {
     get(name: string): GovernedTool | undefined;
     execute<Input, Output>(name: string, input: Input, identity?: AgentIdentity | null): Promise<Output>;
 }
-declare const createToolRegistry: ({ evaluate, setPolicies, listPolicies, onTrace, }: ToolRegistryOptions) => ToolRegistry;
+declare const createToolRegistry: ({ evaluate, setPolicies, listPolicies, onTrace, identityResolver, }: ToolRegistryOptions) => ToolRegistry;
 
 interface ProgressionTransition {
     on: string;
@@ -425,6 +476,19 @@ interface InitOptions {
     auth?: AuthContext;
     progression?: ProgressionConfig;
     tools?: GovernedTool[];
+    /**
+     * Run agent detection automatically on init and keep the resulting
+     * identity in agentContext so every subsequent tools.execute() call gets
+     * attributed without the host page passing identity through. Default
+     * `true` — opt out with `false` for privacy-mode hosts, or pass
+     * DetectAgentOptions to tune the detectors (e.g. raise the DOM threshold).
+     *
+     * The first detection cycle runs synchronously where possible (DOM
+     * heuristics) and continues asynchronously for WebMCP polling, so very
+     * early click handlers may see identity=null for a single frame; the
+     * `ready` promise on the returned client resolves once the cycle finishes.
+     */
+    autoDetect?: boolean | DetectAgentOptions;
     trace?: {
         enabled?: boolean;
         bufferSize?: number;
@@ -452,6 +516,13 @@ interface AgentronicsClient {
     readonly tools: ToolRegistry;
     readonly progression: ProgressionStore | null;
     readonly webmcp: WebMcpAdapter;
+    /**
+     * Resolves once the initial autoDetect cycle finishes. Rejects only if the
+     * autoDetect configuration itself is invalid; detection failures resolve to
+     * `null` (treated as "human or undetectable agent"). When `autoDetect` was
+     * disabled the promise resolves immediately to `null`.
+     */
+    readonly ready: Promise<AgentIdentity | null>;
     detect(options?: DetectAgentOptions): Promise<AgentIdentity | null>;
     authenticate(input: AuthInput): Promise<AgentIdentity | null>;
     presentIdentity(input: PresentIdentityOptions): PresentedIdentity;
@@ -477,6 +548,9 @@ interface AgentronicsClient {
         uninstall: () => void;
     };
     registerTool(tool: GovernedTool): () => void;
+    /** Push the full tool registry to the gateway so the dashboard can render
+     *  the page-wise view (schemas, per-tool tokens, context fullness). */
+    syncTools(): Promise<number>;
     surfaceTools(options?: {
         identity?: AgentIdentity | null;
     }): GovernedTool[];
@@ -516,4 +590,4 @@ interface AgentronicsClient {
 }
 declare const init: (options: InitOptions) => AgentronicsClient;
 
-export { createProgressionStore as $, type AgentronicsClient as A, type ToolGroupSummary as B, type ToolRegistry as C, type DetectAgentOptions as D, type ToolTokenEstimate as E, type TraceInput as F, type GovernedTool as G, type Tracer as H, type InitOptions as I, type WebMcpAdapterOptions as J, type WebMcpProvider as K, type WebMcpToolDescriptor as L, type MemoryCache as M, bundledDetectors as N, createAgentContextStore as O, type PolicyEngine as P, createAuthEngine as Q, type RateLimiter as R, type SiteMemoryListener as S, type TraceExporter as T, createDetectorRegistry as U, createIdentityStore as V, type WebMcpAdapter as W, createMemoryCache as X, createMemoryStore as Y, createPolicyCache as Z, createPolicyEngine as _, type AgentContextListener as a, createRateLimiter as a0, createSiteMemoryStore as a1, createToolRegistry as a2, createTracer as a3, createWebMcpAdapter as a4, decideSurfacing as a5, detectAgent as a6, detectDom as a7, estimateBudget as a8, estimateToolTokens as a9, explainSurfacing as aa, groupTools as ab, init as ac, listGroupNames as ad, surfaceTools as ae, type AgentContextSnapshot as b, type AgentContextStore as c, type AuthEngine as d, type AuthInput as e, type AuthMethod as f, DEFAULT_GROUP as g, type DetectDomOptions as h, type Detector as i, type DetectorRegistry as j, type DetectorStatus as k, type DomSignalName as l, type IdentityStore as m, type MemoryStore as n, type PolicyCache as o, type PresentIdentityOptions as p, type PresentedIdentity as q, type ProgressionConfig as r, type ProgressionStage as s, type ProgressionStore as t, type ProgressionTransition as u, type ProvideForPageInput as v, type SiteMemoryStore as w, type SurfacingContext as x, type SurfacingDecision as y, type TokenBudgetReport as z };
+export { createMemoryCache as $, type AgentronicsClient as A, type SurfacingContext as B, CRAWLER_SIGNATURES as C, type DetectAgentOptions as D, type SurfacingDecision as E, type TokenBudgetReport as F, type GovernedTool as G, type ToolGroupSummary as H, type InitOptions as I, type ToolRegistry as J, type ToolTokenEstimate as K, type TraceInput as L, type MemoryCache as M, type Tracer as N, type WebMcpAdapterOptions as O, type PolicyEngine as P, type WebMcpProvider as Q, type RateLimiter as R, type SiteMemoryListener as S, type TraceExporter as T, type WebMcpToolDescriptor as U, bundledDetectors as V, type WebMcpAdapter as W, createAgentContextStore as X, createAuthEngine as Y, createDetectorRegistry as Z, createIdentityStore as _, type AgentContextListener as a, createMemoryStore as a0, createPolicyCache as a1, createPolicyEngine as a2, createProgressionStore as a3, createRateLimiter as a4, createSiteMemoryStore as a5, createToolRegistry as a6, createTracer as a7, createWebMcpAdapter as a8, decideSurfacing as a9, detectAgent as aa, detectCrawler as ab, detectDom as ac, estimateBudget as ad, estimateToolTokens as ae, explainSurfacing as af, groupTools as ag, init as ah, listGroupNames as ai, surfaceTools as aj, type AgentContextSnapshot as b, type AgentContextStore as c, type AuthEngine as d, type AuthInput as e, type AuthMethod as f, type CrawlerCategory as g, type CrawlerSignature as h, DEFAULT_GROUP as i, type DetectCrawlerOptions as j, type DetectDomOptions as k, type Detector as l, type DetectorRegistry as m, type DetectorStatus as n, type DomSignalName as o, type IdentityStore as p, type MemoryStore as q, type PolicyCache as r, type PresentIdentityOptions as s, type PresentedIdentity as t, type ProgressionConfig as u, type ProgressionStage as v, type ProgressionStore as w, type ProgressionTransition as x, type ProvideForPageInput as y, type SiteMemoryStore as z };

package/dist/init-only.cjs

@@ -1,4 +1,4 @@
-'use strict';var protocol=require('@agentronics/protocol');var st=()=>{if(typeof navigator>"u")return null;let e=navigator.modelContext;return e&&typeof e=="object"?e:null},C=async(e={})=>{let{pollMs:t=500}=e,n=Date.now();for(;;){let r=st();if(r)return at(r);if(Date.now()-n>=t)return null;await new Promise(o=>setTimeout(o,50));}},at=e=>({class:"webmcp",trust:"detected",confidence:1,vendor:e.vendor??e.client??null,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{webmcp:true,toolCount:Array.isArray(e.tools)?e.tools.length:0}});var ct=[/HeadlessChrome/i,/Headless/i,/PhantomJS/i,/SlimerJS/i],lt=()=>({hit:(typeof navigator<"u"&&navigator.webdriver)===true,weight:.6,detail:"navigator.webdriver === true"}),ut=()=>{if(typeof window>"u")return {hit:false,weight:.5};let e=Object.keys(window).filter(t=>t.startsWith("cdc_"));return {hit:e.length>0,weight:.5,detail:`window.${e[0]??"cdc_*"}`}},dt=()=>{if(typeof navigator>"u"||!navigator.plugins)return {hit:false,weight:.2};let e=/Win|Mac|Linux/.test(navigator.userAgent??""),t=navigator.plugins.length===0;return {hit:e&&t,weight:.2,detail:"desktop UA with no plugins"}},pt=()=>{if(typeof navigator>"u")return {hit:false,weight:.7};let e=navigator.userAgent??"",t=ct.some(n=>n.test(e));return t?{hit:t,weight:.7,detail:`headless UA: ${e}`}:{hit:t,weight:.7}},gt=()=>{if(typeof navigator>"u")return {hit:false,weight:.15};let e=navigator.languages;return {hit:!e||e.length===0,weight:.15,detail:"navigator.languages empty"}},mt=()=>{if(typeof navigator>"u")return {hit:false,weight:.1};let e="chrome"in window,t=navigator.userAgent??"";return {hit:/Chrome\//.test(t)&&!/Edg\//.test(t)&&!e,weight:.2,detail:"Chrome UA without window.chrome"}},yt={webdriver:lt,chromedriver:ut,headlessUa:pt,languages:gt,permissions:mt,plugins:dt},O=(e={})=>{let{threshold:t=.4}=e,n={},r=0,o=0;for(let[s,a]of Object.entries(yt)){let l=a();r+=l.weight,n[s]={hit:l.hit,weight:l.weight,detail:l.detail},l.hit&&(o+=l.weight);}let i=r===0?0:o/r;return i<t?null:{class:"dom",trust:"detected",confidence:i,vendor:null,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:n}};var ae=()=>[{id:"webmcp.model-context",status:"stable",detect:()=>C({pollMs:0})},{id:"dom.automation-heuristics",status:"beta",detect:()=>O()}],U=(e=ae())=>{let t=new Map(e.map(n=>[n.id,n]));return {register(n){t.set(n.id,n);},list(n){let r=[...t.values()];return n?r.filter(o=>o.status===n):r},async detectAll(n=false){for(let r of t.values()){if(r.status==="research"&&!n)continue;let o=await r.detect();if(o)return o}return null}}};var ce=async(e={})=>{if(e.customDetectors?.length){let t=await U(e.customDetectors).detectAll(!!e.experimental);if(t)return t}if(e.webmcp!==false){let t=await C(e.webmcp??{});if(t)return t}if(e.dom!==false){let t=O(e.dom??{});if(t)return t}return null};var wt=e=>({class:e.class,trust:"declared",confidence:1,vendor:e.vendor,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{declared:true,hasToken:true,tokenExpiresAt:e.expiresAt??null}}),le=()=>{let e=null;return {present(t){let n=protocol.IdentityClaim.safeParse(t);if(!n.success)throw new protocol.AgentronicsError("invalid_api_key",`Invalid identity claim: ${n.error.issues[0]?.message??"unknown"}`);let r={claim:n.data,identity:wt(n.data)};return e=r,r},clear(){e=null;},preferOver(t){return e?t?protocol.isHigherTrust(e.identity.trust,t.trust)?e.identity:t:e.identity:t},snapshot(){return e}}};var de=e=>{let t=null;for(let n of e)(!t||protocol.TRUST_RANK[n.trust]>protocol.TRUST_RANK[t.trust])&&(t=n);return t};var pe=()=>({name:"bearer",async authenticate(e,t){if(!e.bearerToken)return null;let n=await t.verifyToken?.("bearer",e.bearerToken);return {class:e.classHint??"dom",trust:n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"bearer",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{bearer:true,verifiedRemotely:!!n}}}});var ge=()=>({name:"detection",async authenticate(e){return e.detected??null}});var me=()=>({name:"extensionToken",async authenticate(e,t){if(!e.extensionToken)return null;let n=await t.verifyToken?.("extensionToken",e.extensionToken);return {class:"dom",trust:n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"browser-extension",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{extensionToken:true,verifiedRemotely:!!n}}}});var ye=()=>({name:"mtls",async authenticate(e,t){if(!e.xfccHeader)return null;let n=await t.verifyToken?.("mtls",e.xfccHeader);return {class:e.classHint??"webmcp",trust:n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"mtls",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{mtls:true,subject:n?.subject??null,verifiedRemotely:!!n,...n?.signals??{}}}}});var fe=()=>({name:"oauth2",async authenticate(e,t){if(!e.oauth2AccessToken)return null;let n=await t.verifyToken?.("oauth2",e.oauth2AccessToken);return {class:e.classHint??"webmcp",trust:e.oauth2Subject?"linked":n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"oauth2",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{oauth2:true,subject:e.oauth2Subject??null,verifiedRemotely:!!n}}}});var bt=e=>({class:e.class,trust:"declared",confidence:1,vendor:e.vendor,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{declared:true,hasToken:true,tokenExpiresAt:e.expiresAt??null}}),he=()=>({name:"selfDeclaration",async authenticate(e){return e.declaration?bt(protocol.IdentityClaim.parse(e.declaration)):null}});var ve=()=>({name:"sessionLink",async authenticate(e,t){if(!e.sessionLinkToken)return null;let n=await t.verifyToken?.("sessionLink",e.sessionLinkToken);return {class:e.classHint??"screenshot",trust:e.linkedUserId?"linked":n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"session-link",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{sessionLink:true,linkedUserId:e.linkedUserId??null,verifiedRemotely:!!n}}}});var we=()=>({name:"sso",async authenticate(e,t){if(!e.ssoIdToken)return null;let n=await t.verifyToken?.("sso",e.ssoIdToken);return {class:e.classHint??"dom",trust:n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"sso",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{sso:true,subject:n?.subject??null,verifiedRemotely:!!n,...n?.signals??{}}}}});var xe=()=>({name:"spiffe",async authenticate(e,t){if(!e.spiffeJwt)return null;let n=await t.verifyToken?.("spiffe",e.spiffeJwt),r=n?.vendor==="google";return {class:e.classHint??"webmcp",trust:n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"spiffe",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{spiffe:true,spiffeId:n?.subject??null,subject:n?.subject??null,verifiedRemotely:!!n,...r?{googleAgent:true}:{},...n?.signals??{}}}}});var be=()=>({name:"xAgentHeader",async authenticate(e){if(!e.xAgentHeader)return null;let[t="x-agent",n="dom",r]=e.xAgentHeader.split(";"),o=protocol.AgentClass.safeParse(n);return {class:o.success?o.data:"dom",trust:r?"verified":"declared",confidence:r?1:.8,vendor:t,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{xAgentHeader:true,hasProof:!!r}}}});var St=()=>[ge(),he(),pe(),be(),me(),ve(),fe(),we(),xe(),ye()],At={detection:"detection",selfDeclaration:"declaration",bearer:"bearer",xAgentHeader:"x-agent-header",extensionToken:"extension",sessionLink:"session-link",oauth2:"oauth2",sso:"sso",spiffe:"spiffe",mtls:"mtls"},kt=(e,t)=>e==="spiffe"&&t.signals?.googleAgent===true?"google-agent":At[e],Te=({methods:e=St(),context:t={},onTrace:n}={})=>({async authenticate(r){let o=[],i={};for(let g of e){let u=await g.authenticate(r,t);i[g.name]=!!u,u&&o.push({method:g.name,identity:u});}let s=de(o.map(g=>g.identity)),a=s?o.find(g=>g.identity===s):void 0,l=a?kt(a.method,a.identity):void 0,d=typeof s?.signals?.subject=="string"?s.signals.subject:void 0,p={type:s?"auth.identity_presented":"sdk.error",agent:s,outcome:s?"success":"error",metadata:{methods:i,...l?{protocol:l}:{},...d?{subject:d}:{}}};return s||(p.error="No auth method produced an identity."),n?.(p),s},methods(){return e.map(r=>r.name)}});var Mt={identity:null,source:"initial",updatedAt:null},Se=()=>{let e=Mt,t=new Set,n=()=>{t.size!==0&&t.forEach(r=>r(e));};return {snapshot(){return e},set(r,o){e={identity:r,source:o,updatedAt:new Date().toISOString()},n();},subscribe(r){return t.add(r),()=>{t.delete(r);}}}};var It=()=>{let e=new Map;return {read:t=>e.get(t)??null,write:(t,n)=>{e.set(t,n);}}},Pt=()=>typeof window>"u"||!window.localStorage?It():{read:e=>{try{return window.localStorage.getItem(e)}catch{return null}},write:(e,t)=>{try{window.localStorage.setItem(e,t);}catch{}}},Rt=e=>{if(!e)return null;try{let t=JSON.parse(e);if(typeof t=="object"&&t!==null&&Number.isFinite(t.count)&&Number.isFinite(t.resetAt))return t}catch{return null}return null},Ae=(e=Pt())=>({consume(t,n,r=Date.now()){let o=`agtx:rate:${t}`,i=Rt(e.read(o)),s=i&&i.resetAt>r?i.resetAt:r+n.windowSeconds*1e3,a=i&&i.resetAt>r?i.count+1:1;return e.write(o,JSON.stringify({count:a,resetAt:s})),{allowed:a<=n.max,remaining:Math.max(0,n.max-a),resetAt:s}}});var Et=(e,t)=>e==="*"||e===t?true:e.includes("*")?new RegExp("^"+e.replace(/[.+?^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*")+"$").test(t):false,Ct=(e,t)=>{let n=e?protocol.TRUST_RANK[e.trust]:-1,r=protocol.TRUST_RANK[t.minTrust];return n>=r},Ot=(e,t)=>t.allowedClasses.length===0?true:e?t.allowedClasses.includes(e.class):false,Ie="review",Dt=(e,t)=>{let n=t?.class??"unknown",r=t?.vendor??"unknown",o=t?.trust??"none";return `${e}:${n}:${r}:${o}`},Pe=(e=[],t={})=>{let n=e.map(o=>protocol.PolicyRule.parse(o)),r=t.rateLimiter??Ae();return {set(o){n=o.map(i=>protocol.PolicyRule.parse(i));},list(){return [...n]},evaluate({tool:o,identity:i}){for(let s of n)if(Et(s.tool,o)){if(!Ct(i,s))return {decision:"deny",ruleId:s.id,reason:`Rule "${s.id}" requires trust >= ${s.minTrust}.`};if(!Ot(i,s))return {decision:"deny",ruleId:s.id,reason:`Rule "${s.id}" restricts to classes: ${s.allowedClasses.join(", ")}.`};if(s.rateLimit){let a=r.consume(Dt(o,i),s.rateLimit);if(!a.allowed)return {decision:"deny",ruleId:s.id,reason:`Rule "${s.id}" rate limit exceeded. Resets at ${new Date(a.resetAt).toISOString()}.`}}return {decision:s.decision,ruleId:s.id,reason:`Matched rule "${s.id}".`}}return {decision:Ie,ruleId:null,reason:`No rule matched tool "${o}". Falling back to "${Ie}".`}}}};var Re=({gatewayUrl:e,siteId:t,publishableKey:n,fetcher:r=fetch})=>{let o={policies:[],etag:null};return {snapshot(){return {policies:[...o.policies],etag:o.etag}},async sync(){let i=await r(`${e.replace(/\/$/,"")}/v1/sites/${encodeURIComponent(t)}/policies`,{headers:{authorization:`Bearer ${n}`,...o.etag?{"if-none-match":o.etag}:{}}});if(i.status===304)return this.snapshot();if(!i.ok)throw new Error(`Policy sync failed with status ${i.status}.`);let s=await i.json();return o={policies:protocol.PolicyRule.array().parse(s.policies??[]),etag:i.headers.get("etag")},this.snapshot()}}};var Ee=({message:e="Agent action blocked by site policy.",durationMs:t=2400,documentRef:n=typeof document>"u"?void 0:document}={})=>{if(!n?.body)return null;let r=n.createElement("div");return r.setAttribute("role","status"),r.setAttribute("data-agentronics-deny-overlay","true"),r.textContent=e,Object.assign(r.style,{position:"fixed",zIndex:"2147483647",left:"50%",bottom:"24px",transform:"translateX(-50%)",maxWidth:"min(520px, calc(100vw - 32px))",padding:"12px 16px",borderRadius:"8px",background:"#07091A",color:"#F4F4F5",border:"1px solid #6366F1",boxShadow:"0 20px 48px -16px rgba(7,9,26,0.55)",font:"13px/1.45 'Space Mono', ui-monospace, SFMono-Regular, Menlo, monospace"}),n.body.appendChild(r),window.setTimeout(()=>r.remove(),t),r};var Ce=({policyEngine:e,getIdentity:t,documentRef:n=typeof document>"u"?void 0:document,selector:r="[data-agentronics-tool]"})=>{if(!n)return {uninstall:()=>{}};let o=i=>{let s=i.target instanceof Element?i.target.closest(r):null;if(!(s instanceof HTMLElement))return;let a=s.dataset.agentronicsTool;a&&Promise.resolve(t()).then(l=>{let d=e.evaluate({tool:a,identity:l});d.decision==="deny"&&(i.preventDefault(),i.stopPropagation(),Ee({message:d.reason,documentRef:n}));});};return n.addEventListener("click",o,true),{uninstall:()=>n.removeEventListener("click",o,true)}};var _=()=>{let e=new Map;return {read:t=>e.get(t)??null,write:(t,n)=>{e.set(t,n);},remove:t=>{e.delete(t);},keys:()=>[...e.keys()]}},Oe=(e,t)=>({read:n=>{try{return e.getItem(t+n)}catch{return null}},write:(n,r)=>{try{e.setItem(t+n,r);}catch{}},remove:n=>{try{e.removeItem(t+n);}catch{}},keys:()=>{let n=[];try{for(let r=0;r<e.length;r++){let o=e.key(r);o&&o.startsWith(t)&&n.push(o.slice(t.length));}}catch{}return n}}),De="agtx:",Le=()=>{let e=typeof window<"u",t=e&&typeof window.sessionStorage<"u"?Oe(window.sessionStorage,De+"session:"):_(),n=e&&typeof window.localStorage<"u"?Oe(window.localStorage,De+"user:"):_();return {session:t,user:n,org:_()}};var je=(e,t)=>e.expiresAt!==null&&e.expiresAt<=t,We=e=>{if(!e)return null;try{let t=JSON.parse(e);return typeof t!="object"||t===null?null:t}catch{return null}},$t=e=>JSON.stringify(e),Ge=(e={})=>{let t=Le(),n=l=>{e.onTrace?.(l);};return {get:(l,d={})=>{let p=d.scope??"session",g=t[p],u=We(g.read(l));if(!u){n({type:"memory.accessed",metadata:{operation:"get",key:l,scope:p,hit:false}});return}if(je(u,Date.now())){g.remove(l),n({type:"memory.accessed",metadata:{operation:"get",key:l,scope:p,hit:false,expired:true}});return}return n({type:"memory.accessed",metadata:{operation:"get",key:l,scope:p,hit:true}}),u.value},set:(l,d,p={})=>{let g=p.scope??"session",u=p.ttlSeconds??null,f=Date.now(),w={value:d,expiresAt:u===null?null:f+u*1e3,updatedAt:new Date(f).toISOString()};return t[g].write(l,$t(w)),n({type:"memory.updated",metadata:{operation:"set",key:l,scope:g,ttlSeconds:u}}),protocol.MemoryEntry.parse({key:l,value:d,scope:g,ttlSeconds:u,updatedAt:w.updatedAt})},remove:(l,d={})=>{let p=d.scope??"session";t[p].remove(l),n({type:"memory.updated",metadata:{operation:"remove",key:l,scope:p}});},list:(l={})=>{let d=l.scope??"session",p=t[d],g=Date.now(),u=[];for(let f of p.keys()){let w=We(p.read(f));if(w){if(je(w,g)){p.remove(f);continue}u.push(protocol.MemoryEntry.parse({key:f,value:w.value,scope:d,ttlSeconds:w.expiresAt===null?null:Math.max(0,Math.round((w.expiresAt-g)/1e3)),updatedAt:w.updatedAt}));}}return n({type:"memory.accessed",metadata:{operation:"list",scope:d,count:u.length}}),u},clear:(l={})=>{let d=l.scope??"session",p=t[d],g=p.keys().length;for(let u of p.keys())p.remove(u);n({type:"memory.updated",metadata:{operation:"clear",scope:d,count:g}});}}};var N=e=>protocol.SiteMemory.parse(JSON.parse(JSON.stringify(e))),L=e=>({...e,updatedAt:new Date().toISOString()}),Be=(e={})=>{let t=protocol.SiteMemory.parse({...protocol.SITE_MEMORY_DEFAULT,...e.initial??{}}),n=null,r=new Set,o=m=>{e.onTrace?.(m);},i=()=>{n=null;},s=()=>{if(r.size===0)return;let m=N(t);n=m,r.forEach(h=>h(m));},a=m=>{let h=protocol.SiteMemory.parse({...t,...m,workflows:{...t.workflows,...m.workflows??{}},policies:{...t.policies,...m.policies??{}},uiGuidance:{...t.uiGuidance,...m.uiGuidance??{}},pageContexts:{...t.pageContexts,...m.pageContexts??{}}});return t=L(h),i(),o({type:"memory.updated",metadata:{kind:"site",operation:"provide",keys:Object.keys(m)}}),s(),p()},l=(m,h)=>{let v=m.split(".").filter(Boolean);if(v.length===0)throw new Error("siteMemory.update() requires a non-empty dot-path.");let A=JSON.parse(JSON.stringify(t)),k=A;for(let M=0;M<v.length-1;M++){let T=v[M],I=k[T];(typeof I!="object"||I===null||Array.isArray(I))&&(k[T]={}),k=k[T];}return k[v[v.length-1]]=h,t=L(protocol.SiteMemory.parse(A)),i(),o({type:"memory.updated",metadata:{kind:"site",operation:"update",path:m}}),s(),p()},d=m=>{let h=protocol.SiteMemoryPageContext.parse({path:m.path,payload:m.payload,updatedAt:new Date().toISOString()});return t=L({...t,pageContexts:{...t.pageContexts,[m.path]:h}}),i(),o({type:"memory.updated",metadata:{kind:"site",operation:"provideForPage",path:m.path}}),s(),{...h,payload:{...h.payload}}},p=()=>(n||(n=N(t)),n);return {provide:a,update:l,provideForPage:d,snapshot:p,get:m=>{if(o({type:"memory.accessed",metadata:{kind:"site",operation:m?"get":"snapshot",path:m??null}}),!m)return N(t);let h=m.split(".").filter(Boolean),v=t;for(let A of h){if(typeof v!="object"||v===null)return;v=v[A];}return v},getForPage:m=>{o({type:"memory.accessed",metadata:{kind:"site",operation:"getForPage",path:m}});let h=t.pageContexts[m];return h?{...h,payload:{...h.payload}}:null},replace:m=>(t=L(protocol.SiteMemory.parse(m)),i(),s(),p()),subscribe:m=>(r.add(m),()=>{r.delete(m);})}};var _e=({gatewayUrl:e,siteId:t,publishableKey:n,fetcher:r=fetch})=>{let o={memory:null,etag:null};return {snapshot(){return {memory:o.memory?protocol.SiteMemory.parse(o.memory):null,etag:o.etag}},async sync(){let i=await r(`${e.replace(/\/$/,"")}/v1/sites/${encodeURIComponent(t)}/memory`,{headers:{authorization:`Bearer ${n}`,...o.etag?{"if-none-match":o.etag}:{}}});if(i.status===304)return this.snapshot();if(!i.ok)throw new Error(`Memory sync failed with status ${i.status}.`);let s=await i.json();return o={memory:protocol.SiteMemory.parse(s.memory??{}),etag:i.headers.get("etag")},this.snapshot()}}};var S="agent-context-",H="agentronics-site-context",Gt=e=>{try{return JSON.stringify(e)}catch{return "{}"}},$=(e,t,n)=>{let r=e.querySelector(`meta[name="${t}"]`);r||(r=e.createElement("meta"),r.setAttribute("name",t),e.head.appendChild(r)),r.setAttribute("content",n);},j=(e,t)=>{e.querySelectorAll(`meta[name="${t}"]`).forEach(n=>n.remove());},F=({doc:e=typeof document>"u"?null:document,snapshot:t,schemaType:n="WebSite"})=>{if(!e)return {uninstall:()=>{}};$(e,`${S}version`,t.version),$(e,`${S}updated-at`,t.updatedAt??new Date().toISOString()),t.siteMap?.navigation?.flow&&$(e,`${S}flow`,t.siteMap.navigation.flow),$(e,`${S}workflows`,Object.keys(t.workflows).join(","));let r=e.getElementById(H);return r||(r=e.createElement("script"),r.type="application/ld+json",r.id=H,e.head.appendChild(r)),r.textContent=Gt({"@context":"https://schema.org","@type":n,name:"Agentronics Site Memory",agentronics:t}),{uninstall:()=>{j(e,`${S}version`),j(e,`${S}updated-at`),j(e,`${S}flow`),j(e,`${S}workflows`),e.getElementById(H)?.remove();}}};var Ne="agentronics-memory-overlay",Bt=e=>`
+'use strict';var protocol=require('@agentronics/protocol');var f="0.1.2";var gt=()=>{if(typeof navigator>"u")return null;let e=navigator.modelContext;return e&&typeof e=="object"?e:null},D=async(e={})=>{let{pollMs:t=500}=e,n=Date.now();for(;;){let r=gt();if(r)return yt(r);if(Date.now()-n>=t)return null;await new Promise(o=>setTimeout(o,50));}},yt=e=>({class:"webmcp",trust:"detected",confidence:1,vendor:e.vendor??e.client??null,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:f,signals:{webmcp:true,toolCount:Array.isArray(e.tools)?e.tools.length:0}});var ue=[{name:"GPTBot",category:"ai",pattern:/GPTBot/i},{name:"OAI-SearchBot",category:"ai",pattern:/OAI-SearchBot/i},{name:"ChatGPT-User",category:"ai",pattern:/ChatGPT-User/i},{name:"ClaudeBot",category:"ai",pattern:/ClaudeBot/i},{name:"Claude-Web",category:"ai",pattern:/Claude-Web/i},{name:"anthropic-ai",category:"ai",pattern:/anthropic-ai/i},{name:"PerplexityBot",category:"ai",pattern:/PerplexityBot/i},{name:"Google-Extended",category:"ai",pattern:/Google-Extended/i},{name:"Applebot-Extended",category:"ai",pattern:/Applebot-Extended/i},{name:"Amazonbot",category:"ai",pattern:/Amazonbot/i},{name:"Bytespider",category:"ai",pattern:/Bytespider/i},{name:"CCBot",category:"ai",pattern:/CCBot/i},{name:"Meta-ExternalAgent",category:"ai",pattern:/Meta-ExternalAgent/i},{name:"cohere-ai",category:"ai",pattern:/cohere-ai/i},{name:"Googlebot",category:"search",pattern:/Googlebot/i},{name:"Bingbot",category:"search",pattern:/bingbot/i},{name:"DuckDuckBot",category:"search",pattern:/DuckDuckBot/i},{name:"YandexBot",category:"search",pattern:/YandexBot/i},{name:"Baiduspider",category:"search",pattern:/Baiduspider/i},{name:"Applebot",category:"search",pattern:/Applebot/i}],L=(e={})=>{let{signatures:t=ue,disable:n=false,confidence:r=.9}=e;if(n||typeof navigator>"u")return null;let o=navigator.userAgent??"";if(!o)return null;for(let a of t)if(a.pattern.test(o))return {class:"crawler",trust:"detected",confidence:r,vendor:a.name,userAgent:o,detectionVersion:f,signals:{matched:a.name,category:a.category,ua:o}};return null};var ft=[/HeadlessChrome/i,/Headless/i,/PhantomJS/i,/SlimerJS/i],ht=()=>({hit:(typeof navigator<"u"&&navigator.webdriver)===true,weight:.6,detail:"navigator.webdriver === true"}),vt=()=>{if(typeof window>"u")return {hit:false,weight:.5};let e=Object.keys(window).filter(t=>t.startsWith("cdc_"));return {hit:e.length>0,weight:.5,detail:`window.${e[0]??"cdc_*"}`}},wt=()=>{if(typeof navigator>"u"||!navigator.plugins)return {hit:false,weight:.2};let e=/Win|Mac|Linux/.test(navigator.userAgent??""),t=navigator.plugins.length===0;return {hit:e&&t,weight:.2,detail:"desktop UA with no plugins"}},xt=()=>{if(typeof navigator>"u")return {hit:false,weight:.7};let e=navigator.userAgent??"",t=ft.some(n=>n.test(e));return t?{hit:t,weight:.7,detail:`headless UA: ${e}`}:{hit:t,weight:.7}},St=()=>{if(typeof navigator>"u")return {hit:false,weight:.15};let e=navigator.languages;return {hit:!e||e.length===0,weight:.15,detail:"navigator.languages empty"}},bt=()=>{if(typeof navigator>"u")return {hit:false,weight:.1};let e="chrome"in window,t=navigator.userAgent??"";return {hit:/Chrome\//.test(t)&&!/Edg\//.test(t)&&!e,weight:.2,detail:"Chrome UA without window.chrome"}},Tt={webdriver:ht,chromedriver:vt,headlessUa:xt,languages:St,permissions:bt,plugins:wt},$=(e={})=>{let{threshold:t=.4}=e,n={},r=0,o=0;for(let[s,y]of Object.entries(Tt)){let i=y();r+=i.weight,n[s]={hit:i.hit,weight:i.weight,detail:i.detail},i.hit&&(o+=i.weight);}let a=r===0?0:o/r;return a<t?null:{class:"dom",trust:"detected",confidence:a,vendor:null,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:f,signals:n}};var pe=()=>[{id:"webmcp.model-context",status:"stable",detect:()=>D({pollMs:0})},{id:"crawler.user-agent",status:"beta",detect:()=>L()},{id:"dom.automation-heuristics",status:"beta",detect:()=>$()}],K=(e=pe())=>{let t=new Map(e.map(n=>[n.id,n]));return {register(n){t.set(n.id,n);},list(n){let r=[...t.values()];return n?r.filter(o=>o.status===n):r},async detectAll(n=false){for(let r of t.values()){if(r.status==="research"&&!n)continue;let o=await r.detect();if(o)return o}return null}}};var de=async(e={})=>{if(e.customDetectors?.length){let t=await K(e.customDetectors).detectAll(!!e.experimental);if(t)return t}if(e.webmcp!==false){let t=await D(e.webmcp??{});if(t)return t}if(e.crawler!==false){let t=L(e.crawler??{});if(t)return t}if(e.dom!==false){let t=$(e.dom??{});if(t)return t}return null};var Mt=e=>({class:e.class,trust:"declared",confidence:1,vendor:e.vendor,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:f,signals:{declared:true,hasToken:true,tokenExpiresAt:e.expiresAt??null}}),me=()=>{let e=null;return {present(t){let n=protocol.IdentityClaim.safeParse(t);if(!n.success)throw new protocol.AgentronicsError("invalid_api_key",`Invalid identity claim: ${n.error.issues[0]?.message??"unknown"}`);let r={claim:n.data,identity:Mt(n.data)};return e=r,r},clear(){e=null;},preferOver(t){return e?t?protocol.isHigherTrust(e.identity.trust,t.trust)?e.identity:t:e.identity:t},snapshot(){return e}}};var ye=e=>{let t=null;for(let n of e)(!t||protocol.TRUST_RANK[n.trust]>protocol.TRUST_RANK[t.trust])&&(t=n);return t};var fe=()=>({name:"bearer",async authenticate(e,t){if(!e.bearerToken)return null;let n=await t.verifyToken?.("bearer",e.bearerToken);return {class:e.classHint??"dom",trust:n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"bearer",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:f,signals:{bearer:true,verifiedRemotely:!!n}}}});var he=()=>({name:"detection",async authenticate(e){return e.detected??null}});var ve=()=>({name:"extensionToken",async authenticate(e,t){if(!e.extensionToken)return null;let n=await t.verifyToken?.("extensionToken",e.extensionToken);return {class:"dom",trust:n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"browser-extension",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:f,signals:{extensionToken:true,verifiedRemotely:!!n}}}});var we=()=>({name:"mtls",async authenticate(e,t){if(!e.xfccHeader)return null;let n=await t.verifyToken?.("mtls",e.xfccHeader);return {class:e.classHint??"webmcp",trust:n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"mtls",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:f,signals:{mtls:true,subject:n?.subject??null,verifiedRemotely:!!n,...n?.signals??{}}}}});var xe=()=>({name:"oauth2",async authenticate(e,t){if(!e.oauth2AccessToken)return null;let n=await t.verifyToken?.("oauth2",e.oauth2AccessToken);return {class:e.classHint??"webmcp",trust:e.oauth2Subject?"linked":n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"oauth2",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:f,signals:{oauth2:true,subject:e.oauth2Subject??null,verifiedRemotely:!!n}}}});var Pt=e=>({class:e.class,trust:"declared",confidence:1,vendor:e.vendor,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:f,signals:{declared:true,hasToken:true,tokenExpiresAt:e.expiresAt??null}}),Se=()=>({name:"selfDeclaration",async authenticate(e){return e.declaration?Pt(protocol.IdentityClaim.parse(e.declaration)):null}});var be=()=>({name:"sessionLink",async authenticate(e,t){if(!e.sessionLinkToken)return null;let n=await t.verifyToken?.("sessionLink",e.sessionLinkToken);return {class:e.classHint??"screenshot",trust:e.linkedUserId?"linked":n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"session-link",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:f,signals:{sessionLink:true,linkedUserId:e.linkedUserId??null,verifiedRemotely:!!n}}}});var Te=()=>({name:"sso",async authenticate(e,t){if(!e.ssoIdToken)return null;let n=await t.verifyToken?.("sso",e.ssoIdToken);return {class:e.classHint??"dom",trust:n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"sso",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:f,signals:{sso:true,subject:n?.subject??null,verifiedRemotely:!!n,...n?.signals??{}}}}});var Ae=()=>({name:"spiffe",async authenticate(e,t){if(!e.spiffeJwt)return null;let n=await t.verifyToken?.("spiffe",e.spiffeJwt),r=n?.vendor==="google";return {class:e.classHint??"webmcp",trust:n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"spiffe",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:f,signals:{spiffe:true,spiffeId:n?.subject??null,subject:n?.subject??null,verifiedRemotely:!!n,...r?{googleAgent:true}:{},...n?.signals??{}}}}});var ke=()=>({name:"xAgentHeader",async authenticate(e){if(!e.xAgentHeader)return null;let[t="x-agent",n="dom",r]=e.xAgentHeader.split(";"),o=protocol.AgentClass.safeParse(n);return {class:o.success?o.data:"dom",trust:r?"verified":"declared",confidence:r?1:.8,vendor:t,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:f,signals:{xAgentHeader:true,hasProof:!!r}}}});var Ct=()=>[he(),Se(),fe(),ke(),ve(),be(),xe(),Te(),Ae(),we()],Ot={detection:"detection",selfDeclaration:"declaration",bearer:"bearer",xAgentHeader:"x-agent-header",extensionToken:"extension",sessionLink:"session-link",oauth2:"oauth2",sso:"sso",spiffe:"spiffe",mtls:"mtls"},Dt=(e,t)=>e==="spiffe"&&t.signals?.googleAgent===true?"google-agent":Ot[e],Ie=({methods:e=Ct(),context:t={},onTrace:n}={})=>({async authenticate(r){let o=[],a={};for(let d of e){let p=await d.authenticate(r,t);a[d.name]=!!p,p&&o.push({method:d.name,identity:p});}let s=ye(o.map(d=>d.identity)),y=s?o.find(d=>d.identity===s):void 0,i=y?Dt(y.method,y.identity):void 0,g=typeof s?.signals?.subject=="string"?s.signals.subject:void 0,u={type:s?"auth.identity_presented":"sdk.error",agent:s,outcome:s?"success":"error",metadata:{methods:a,...i?{protocol:i}:{},...g?{subject:g}:{}}};return s||(u.error="No auth method produced an identity."),n?.(u),s},methods(){return e.map(r=>r.name)}});var Lt={identity:null,source:"initial",updatedAt:null},Me=()=>{let e=Lt,t=new Set,n=()=>{t.size!==0&&t.forEach(r=>r(e));};return {snapshot(){return e},set(r,o){e={identity:r,source:o,updatedAt:new Date().toISOString()},n();},subscribe(r){return t.add(r),()=>{t.delete(r);}}}};var $t=()=>{let e=new Map;return {read:t=>e.get(t)??null,write:(t,n)=>{e.set(t,n);}}},jt=()=>typeof window>"u"||!window.localStorage?$t():{read:e=>{try{return window.localStorage.getItem(e)}catch{return null}},write:(e,t)=>{try{window.localStorage.setItem(e,t);}catch{}}},Wt=e=>{if(!e)return null;try{let t=JSON.parse(e);if(typeof t=="object"&&t!==null&&Number.isFinite(t.count)&&Number.isFinite(t.resetAt))return t}catch{return null}return null},Re=(e=jt())=>({consume(t,n,r=Date.now()){let o=`agtx:rate:${t}`,a=Wt(e.read(o)),s=a&&a.resetAt>r?a.resetAt:r+n.windowSeconds*1e3,y=a&&a.resetAt>r?a.count+1:1;return e.write(o,JSON.stringify({count:y,resetAt:s})),{allowed:y<=n.max,remaining:Math.max(0,n.max-y),resetAt:s}}});var Bt=(e,t)=>e==="*"||e===t?true:e.includes("*")?new RegExp("^"+e.replace(/[.+?^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*")+"$").test(t):false,Gt=(e,t)=>{let n=e?protocol.TRUST_RANK[e.trust]:-1,r=protocol.TRUST_RANK[t.minTrust];return n>=r},Nt=(e,t)=>t.allowedClasses.length===0?true:e?t.allowedClasses.includes(e.class):false,Ce="review",_t=(e,t)=>{let n=t?.class??"unknown",r=t?.vendor??"unknown",o=t?.trust??"none";return `${e}:${n}:${r}:${o}`},Oe=(e=[],t={})=>{let n=e.map(o=>protocol.PolicyRule.parse(o)),r=t.rateLimiter??Re();return {set(o){n=o.map(a=>protocol.PolicyRule.parse(a));},list(){return [...n]},evaluate({tool:o,identity:a}){for(let s of n)if(Bt(s.tool,o)){if(!Gt(a,s))return {decision:"deny",ruleId:s.id,reason:`Rule "${s.id}" requires trust >= ${s.minTrust}.`};if(!Nt(a,s))return {decision:"deny",ruleId:s.id,reason:`Rule "${s.id}" restricts to classes: ${s.allowedClasses.join(", ")}.`};if(s.rateLimit){let y=r.consume(_t(o,a),s.rateLimit);if(!y.allowed)return {decision:"deny",ruleId:s.id,reason:`Rule "${s.id}" rate limit exceeded. Resets at ${new Date(y.resetAt).toISOString()}.`}}return {decision:s.decision,ruleId:s.id,reason:`Matched rule "${s.id}".`}}return {decision:Ce,ruleId:null,reason:`No rule matched tool "${o}". Falling back to "${Ce}".`}}}};var De=({gatewayUrl:e,siteId:t,publishableKey:n,fetcher:r=fetch})=>{let o={policies:[],etag:null};return {snapshot(){return {policies:[...o.policies],etag:o.etag}},async sync(){let a=await r(`${e.replace(/\/$/,"")}/v1/sites/${encodeURIComponent(t)}/policies`,{headers:{authorization:`Bearer ${n}`,...o.etag?{"if-none-match":o.etag}:{}}});if(a.status===304)return this.snapshot();if(!a.ok)throw new Error(`Policy sync failed with status ${a.status}.`);let s=await a.json();return o={policies:protocol.PolicyRule.array().parse(s.policies??[]),etag:a.headers.get("etag")},this.snapshot()}}};var Le=({message:e="Agent action blocked by site policy.",durationMs:t=2400,documentRef:n=typeof document>"u"?void 0:document}={})=>{if(!n?.body)return null;let r=n.createElement("div");return r.setAttribute("role","status"),r.setAttribute("data-agentronics-deny-overlay","true"),r.textContent=e,Object.assign(r.style,{position:"fixed",zIndex:"2147483647",left:"50%",bottom:"24px",transform:"translateX(-50%)",maxWidth:"min(520px, calc(100vw - 32px))",padding:"12px 16px",borderRadius:"8px",background:"#07091A",color:"#F4F4F5",border:"1px solid #6366F1",boxShadow:"0 20px 48px -16px rgba(7,9,26,0.55)",font:"13px/1.45 'Space Mono', ui-monospace, SFMono-Regular, Menlo, monospace"}),n.body.appendChild(r),window.setTimeout(()=>r.remove(),t),r};var $e=({policyEngine:e,getIdentity:t,documentRef:n=typeof document>"u"?void 0:document,selector:r="[data-agentronics-tool]"})=>{if(!n)return {uninstall:()=>{}};let o=a=>{let s=a.target instanceof Element?a.target.closest(r):null;if(!(s instanceof HTMLElement))return;let y=s.dataset.agentronicsTool;y&&Promise.resolve(t()).then(i=>{let g=e.evaluate({tool:y,identity:i});g.decision==="deny"&&(a.preventDefault(),a.stopPropagation(),Le({message:g.reason,documentRef:n}));});};return n.addEventListener("click",o,true),{uninstall:()=>n.removeEventListener("click",o,true)}};var H=()=>{let e=new Map;return {read:t=>e.get(t)??null,write:(t,n)=>{e.set(t,n);},remove:t=>{e.delete(t);},keys:()=>[...e.keys()]}},je=(e,t)=>({read:n=>{try{return e.getItem(t+n)}catch{return null}},write:(n,r)=>{try{e.setItem(t+n,r);}catch{}},remove:n=>{try{e.removeItem(t+n);}catch{}},keys:()=>{let n=[];try{for(let r=0;r<e.length;r++){let o=e.key(r);o&&o.startsWith(t)&&n.push(o.slice(t.length));}}catch{}return n}}),We="agtx:",Be=()=>{let e=typeof window<"u",t=e&&typeof window.sessionStorage<"u"?je(window.sessionStorage,We+"session:"):H(),n=e&&typeof window.localStorage<"u"?je(window.localStorage,We+"user:"):H();return {session:t,user:n,org:H()}};var Ne=(e,t)=>e.expiresAt!==null&&e.expiresAt<=t,_e=e=>{if(!e)return null;try{let t=JSON.parse(e);return typeof t!="object"||t===null?null:t}catch{return null}},Kt=e=>JSON.stringify(e),Ue=(e={})=>{let t=Be(),n=i=>{e.onTrace?.(i);};return {get:(i,g={})=>{let u=g.scope??"session",d=t[u],p=_e(d.read(i));if(!p){n({type:"memory.accessed",metadata:{operation:"get",key:i,scope:u,hit:false}});return}if(Ne(p,Date.now())){d.remove(i),n({type:"memory.accessed",metadata:{operation:"get",key:i,scope:u,hit:false,expired:true}});return}return n({type:"memory.accessed",metadata:{operation:"get",key:i,scope:u,hit:true}}),p.value},set:(i,g,u={})=>{let d=u.scope??"session",p=u.ttlSeconds??null,h=Date.now(),w={value:g,expiresAt:p===null?null:h+p*1e3,updatedAt:new Date(h).toISOString()};return t[d].write(i,Kt(w)),n({type:"memory.updated",metadata:{operation:"set",key:i,scope:d,ttlSeconds:p}}),protocol.MemoryEntry.parse({key:i,value:g,scope:d,ttlSeconds:p,updatedAt:w.updatedAt})},remove:(i,g={})=>{let u=g.scope??"session";t[u].remove(i),n({type:"memory.updated",metadata:{operation:"remove",key:i,scope:u}});},list:(i={})=>{let g=i.scope??"session",u=t[g],d=Date.now(),p=[];for(let h of u.keys()){let w=_e(u.read(h));if(w){if(Ne(w,d)){u.remove(h);continue}p.push(protocol.MemoryEntry.parse({key:h,value:w.value,scope:g,ttlSeconds:w.expiresAt===null?null:Math.max(0,Math.round((w.expiresAt-d)/1e3)),updatedAt:w.updatedAt}));}}return n({type:"memory.accessed",metadata:{operation:"list",scope:g,count:p.length}}),p},clear:(i={})=>{let g=i.scope??"session",u=t[g],d=u.keys().length;for(let p of u.keys())u.remove(p);n({type:"memory.updated",metadata:{operation:"clear",scope:g,count:d}});}}};var V=e=>protocol.SiteMemory.parse(JSON.parse(JSON.stringify(e))),B=e=>({...e,updatedAt:new Date().toISOString()}),Ke=(e={})=>{let t=protocol.SiteMemory.parse({...protocol.SITE_MEMORY_DEFAULT,...e.initial??{}}),n=null,r=new Set,o=l=>{e.onTrace?.(l);},a=()=>{n=null;},s=()=>{if(r.size===0)return;let l=V(t);n=l,r.forEach(v=>v(l));},y=l=>{let v=protocol.SiteMemory.parse({...t,...l,workflows:{...t.workflows,...l.workflows??{}},policies:{...t.policies,...l.policies??{}},uiGuidance:{...t.uiGuidance,...l.uiGuidance??{}},pageContexts:{...t.pageContexts,...l.pageContexts??{}}});return t=B(v),a(),o({type:"memory.updated",metadata:{kind:"site",operation:"provide",keys:Object.keys(l)}}),s(),u()},i=(l,v)=>{let x=l.split(".").filter(Boolean);if(x.length===0)throw new Error("siteMemory.update() requires a non-empty dot-path.");let k=JSON.parse(JSON.stringify(t)),I=k;for(let R=0;R<x.length-1;R++){let T=x[R],P=I[T];(typeof P!="object"||P===null||Array.isArray(P))&&(I[T]={}),I=I[T];}return I[x[x.length-1]]=v,t=B(protocol.SiteMemory.parse(k)),a(),o({type:"memory.updated",metadata:{kind:"site",operation:"update",path:l}}),s(),u()},g=l=>{let v=protocol.SiteMemoryPageContext.parse({path:l.path,payload:l.payload,updatedAt:new Date().toISOString()});return t=B({...t,pageContexts:{...t.pageContexts,[l.path]:v}}),a(),o({type:"memory.updated",metadata:{kind:"site",operation:"provideForPage",path:l.path}}),s(),{...v,payload:{...v.payload}}},u=()=>(n||(n=V(t)),n);return {provide:y,update:i,provideForPage:g,snapshot:u,get:l=>{if(o({type:"memory.accessed",metadata:{kind:"site",operation:l?"get":"snapshot",path:l??null}}),!l)return V(t);let v=l.split(".").filter(Boolean),x=t;for(let k of v){if(typeof x!="object"||x===null)return;x=x[k];}return x},getForPage:l=>{o({type:"memory.accessed",metadata:{kind:"site",operation:"getForPage",path:l}});let v=t.pageContexts[l];return v?{...v,payload:{...v.payload}}:null},replace:l=>(t=B(protocol.SiteMemory.parse(l)),a(),s(),u()),subscribe:l=>(r.add(l),()=>{r.delete(l);})}};var Ve=({gatewayUrl:e,siteId:t,publishableKey:n,fetcher:r=fetch})=>{let o={memory:null,etag:null};return {snapshot(){return {memory:o.memory?protocol.SiteMemory.parse(o.memory):null,etag:o.etag}},async sync(){let a=await r(`${e.replace(/\/$/,"")}/v1/sites/${encodeURIComponent(t)}/memory`,{headers:{authorization:`Bearer ${n}`,...o.etag?{"if-none-match":o.etag}:{}}});if(a.status===304)return this.snapshot();if(!a.ok)throw new Error(`Memory sync failed with status ${a.status}.`);let s=await a.json();return o={memory:protocol.SiteMemory.parse(s.memory??{}),etag:a.headers.get("etag")},this.snapshot()}}};var A="agent-context-",z="agentronics-site-context",zt=e=>{try{return JSON.stringify(e)}catch{return "{}"}},G=(e,t,n)=>{let r=e.querySelector(`meta[name="${t}"]`);r||(r=e.createElement("meta"),r.setAttribute("name",t),e.head.appendChild(r)),r.setAttribute("content",n);},N=(e,t)=>{e.querySelectorAll(`meta[name="${t}"]`).forEach(n=>n.remove());},F=({doc:e=typeof document>"u"?null:document,snapshot:t,schemaType:n="WebSite"})=>{if(!e)return {uninstall:()=>{}};G(e,`${A}version`,t.version),G(e,`${A}updated-at`,t.updatedAt??new Date().toISOString()),t.siteMap?.navigation?.flow&&G(e,`${A}flow`,t.siteMap.navigation.flow),G(e,`${A}workflows`,Object.keys(t.workflows).join(","));let r=e.getElementById(z);return r||(r=e.createElement("script"),r.type="application/ld+json",r.id=z,e.head.appendChild(r)),r.textContent=zt({"@context":"https://schema.org","@type":n,name:"Agentronics Site Memory",agentronics:t}),{uninstall:()=>{N(e,`${A}version`),N(e,`${A}updated-at`),N(e,`${A}flow`),N(e,`${A}workflows`),e.getElementById(z)?.remove();}}};var ze="agentronics-memory-overlay",Ft=e=>`
 position: fixed;
 bottom: 16px;
 right: 16px;
@@ -12,6 +12,6 @@ z-index: 2147483647;
 opacity: ${e?"0":"1"};
 pointer-events: ${e?"none":"auto"};
 box-shadow: 0 12px 32px rgba(15, 23, 42, 0.35);
-`,He=e=>{let t=e.siteMap?.pages?.length??0,n=Object.keys(e.workflows).length,r=Object.keys(e.uiGuidance).length;return `Agentronics site memory \xB7 pages:${t} \xB7 workflows:${n} \xB7 ui-hints:${r}`},K=({doc:e=typeof document>"u"?null:document,snapshot:t,hidden:n=false})=>{if(!e)return {uninstall:()=>{},refresh:()=>{}};let r=e.getElementById(Ne);return r||(r=e.createElement("div"),r.id=Ne,r.setAttribute("role","note"),r.setAttribute("aria-label","Agentronics site memory summary"),r.setAttribute("data-agent-context","overlay"),e.body.appendChild(r)),r.setAttribute("style",Bt(n)),r.textContent=He(t),{uninstall:()=>{r?.remove();},refresh:o=>{r&&(r.textContent=He(o));}}};var Fe="/.well-known/agent-context.json",z=async({origin:e,fetcher:t=fetch,signal:n}={})=>{let r=(e?e.replace(/\/$/,""):typeof window<"u"?window.location.origin:"")+Fe;if(!r.startsWith("http"))return null;let o={headers:{accept:"application/json"}};n!==void 0&&(o.signal=n);let i=await t(r,o);if(!i.ok){if(i.status===404)return null;throw new Error(`well-known agent-context fetch failed with status ${i.status}.`)}let s=await i.json();return protocol.SiteMemory.parse(s)};var Ke=({evaluate:e,setPolicies:t,listPolicies:n,onTrace:r})=>{let o=new Map,i=new Set,s=a=>{if(!a.authz||!t||!n)return;let l={id:`tool:${a.name}`,tool:a.name,...a.authz,rateLimit:a.rateLimit??a.authz.rateLimit};t([...n().filter(d=>d.id!==l.id),l]);};return {register(a){return o.set(a.name,a),i.delete(a.name),s(a),r?.({type:"tool.registered",tool:a.name,metadata:{version:a.version??null,group:a.group??null,stage:a.stage??null}}),()=>{o.delete(a.name),i.delete(a.name);}},unregister(a){o.delete(a),i.delete(a);},enable(a){!o.has(a)||!i.has(a)||(i.delete(a),r?.({type:"tool.surfaced",tool:a,metadata:{state:"enabled"}}));},disable(a){!o.has(a)||i.has(a)||(i.add(a),r?.({type:"tool.surfaced",tool:a,metadata:{state:"disabled"}}));},isEnabled:a=>o.has(a)&&!i.has(a),list({includeDisabled:a=false}={}){let l=[...o.values()];return a?l:l.filter(d=>!i.has(d.name))},get:a=>o.get(a),async execute(a,l,d=null){let p=o.get(a);if(!p)throw new Error(`Tool "${a}" is not registered.`);if(i.has(a)){let f={decision:"deny",ruleId:`tool:${a}`,reason:"Tool is disabled."};throw r?.({type:"tool.executed",tool:a,agent:d,policy:f,outcome:"blocked"}),new Error(f.reason)}let g=await e(a,{identity:d});if(g.decision==="deny")throw r?.({type:"tool.executed",tool:a,agent:d,policy:g,outcome:"blocked"}),new Error(g.reason);let u=Date.now();try{let f=await p.execute(l,{identity:d});return r?.({type:"tool.executed",tool:a,agent:d,policy:g,outcome:"success",durationMs:Date.now()-u}),f}catch(f){throw r?.({type:"tool.executed",tool:a,agent:d,policy:g,outcome:"error",durationMs:Date.now()-u,error:f instanceof Error?f.message:String(f)}),f}}}};var ze=(e,t={})=>{let n=new Map;for(let s of e.stages)n.set(s.name,s);if(!n.has(e.initial))throw new Error(`Initial stage "${e.initial}" is not declared in progression stages.`);let r=e.initial,o=()=>{let s=n.get(r);return s?.enables?[r,...s.enables]:[r]},i=(s,a)=>{let l=r;if(!n.has(s))throw new Error(`Cannot transition to unknown stage "${s}".`);return s===r?{changed:false,from:l,to:s}:(r=s,t.onTrace?.({type:"tool.progressed",metadata:{from:l,to:s,trigger:a}}),{changed:true,from:l,to:s})};return {current:()=>r,enabledStages:()=>o(),notify(s){let l=n.get(r)?.transitions?.find(d=>d.on===s);return l?i(l.to,s):{changed:false,from:r,to:r}},set(s){return i(s,"manual")},reset(){let s=r;r=e.initial,s!==r&&t.onTrace?.({type:"tool.progressed",metadata:{from:s,to:r,trigger:"reset"}});},snapshot:()=>({current:r,enabled:o()})}};var _t=(e,t)=>{let n=e.authz?.minTrust;return n?t?protocol.TRUST_RANK[t.trust]<protocol.TRUST_RANK[n]?{ok:false,reason:`trust-too-low:${t.trust}<${n}`}:{ok:true,reason:"trust-ok"}:{ok:false,reason:`requires-trust:${n}`}:{ok:true,reason:"no-trust-floor"}},Nt=(e,t)=>{let n=e.authz?.allowedClasses??[];return n.length===0?{ok:true,reason:"no-class-restriction"}:t?n.includes(t.class)?{ok:true,reason:"class-ok"}:{ok:false,reason:`class-not-allowed:${t.class}`}:{ok:false,reason:`requires-class:${n.join("|")}`}},Ht=(e,t)=>e.stage?t.enabledStages&&t.enabledStages.includes(e.stage)?{ok:true,reason:`stage-enabled:${e.stage}`}:t.stage===e.stage?{ok:true,reason:`stage-active:${e.stage}`}:{ok:false,reason:`stage-locked:${e.stage}`}:{ok:true,reason:"no-stage"},Ve=(e,t)=>{let n=_t(e,t.identity);if(!n.ok)return {tool:e,visible:false,reason:n.reason};let r=Nt(e,t.identity);if(!r.ok)return {tool:e,visible:false,reason:r.reason};let o=Ht(e,t);return o.ok?e.authz?.decision==="deny"?{tool:e,visible:false,reason:"authz-deny"}:{tool:e,visible:true,reason:"visible"}:{tool:e,visible:false,reason:o.reason}},qe=(e,t)=>e.filter(n=>Ve(n,t).visible),Xe=(e,t)=>e.map(n=>Ve(n,t));var Ft="default",Ye=e=>{let t=new Map;for(let n of e){let r=n.group??Ft,o=t.get(r)??[];o.push(n),t.set(r,o);}return [...t.entries()].sort(([n],[r])=>n.localeCompare(r)).map(([n,r])=>({name:n,tools:r}))};var J=e=>e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(J).join(",")}]`:`{${Object.keys(e).sort().map(n=>`${JSON.stringify(n)}:${J(e[n])}`).join(",")}}`,Kt=e=>{let t={name:e.name,version:e.version??null,group:e.group??null,description:e.description??null,inputSchema:e.inputSchema??null,authz:e.authz??null,rateLimit:e.rateLimit??null},n=J(t).length;return {name:e.name,characters:n,tokens:Math.ceil(n/4)}},Qe=e=>{let t=e.map(Kt);return {total:t.reduce((r,o)=>r+o.tokens,0),perTool:t}};var Ze=e=>e.provider?e.provider:(e.doc?.defaultView??(typeof globalThis<"u"?globalThis:null))?.navigator?.modelContext??null,zt=(e,t)=>{let n={name:e.name,invoke:r=>t(e,r)};return e.description!==void 0&&(n.description=e.description),e.inputSchema!==void 0&&(n.inputSchema=e.inputSchema),n},et=(e={})=>{let t=e.invoke??(async(r,o)=>r.execute(o,{identity:null})),n=null;return {publish(r){let o=Ze(e);return o?(n?.revoke(),n=o.provideContext({tools:r.map(i=>zt(i,t))}),{revoked:true}):{revoked:false}},revoke(){n?.revoke(),n=null;},available:()=>!!Ze(e)}};var V=(e=500)=>{let t=[];return {add(n){t.push(n),t.length>e&&t.splice(0,t.length-e);},list(){return [...t]},clear(){t.length=0;}}};var tt=(e,t)=>e===void 0?t:Math.max(0,Math.min(1,e)),q=(e={})=>{let t=tt(e.traceRate,1),n=tt(e.errorRate,1),r=e.random??Math.random;return {shouldKeep(o){let i=o.outcome==="error"?n:t;return r()<i}}};var Jt="[REDACTED]",Vt=e=>{if(e!==void 0)return JSON.parse(JSON.stringify(e))},X=(e,t)=>{if(t.length===0||typeof e!="object"||e===null)return;let[n,...r]=t;if(!n)return;if(Array.isArray(e)){for(let i of e)X(i,t);return}let o=e;if(n in o){if(r.length===0){o[n]=Jt;return}X(o[n],r);}},Y=(e,t=[])=>{if(t.length===0)return e;let n=Vt(e);for(let r of t)X(n,r.split(".").filter(Boolean));return n},Q=["metadata.password","metadata.token","metadata.authorization","metadata.cookie"];var Xt=()=>typeof location<"u"&&typeof location.pathname=="string"?location.pathname:void 0,nt=e=>{let t=globalThis.crypto;return t&&"randomUUID"in t?`${e}_${t.randomUUID()}`:`${e}_${Date.now().toString(36)}_${Math.random().toString(36).slice(2)}`},Z=({siteId:e,bufferSize:t,sessionId:n=nt("ses"),scrubPaths:r=Q,exporters:o=[],onExporterError:i,pageProvider:s=Xt,...a})=>{let l=V(t),d=q(a),p=()=>{try{return s()}catch{return}};return {sessionId:n,async emit(g){let u={...g.metadata};if(u.page===void 0){let w=p();w!==void 0&&(u.page=w);}let f=protocol.TraceEvent.parse(Y({id:nt("trc"),siteId:e,sessionId:n,occurredAt:new Date().toISOString(),outcome:g.outcome??"success",...g,metadata:u},r));return d.shouldKeep(f)?(l.add(f),await Promise.all(o.map(async w=>{try{await w.export([f]);}catch(m){i?.(m,w,f);}})),f):null},list:()=>l.list(),clear:()=>l.clear()}};var ee=()=>({name:"console",export(e){for(let t of e)console.info("[agentronics:trace]",t.type,t);}});var te=({gatewayUrl:e,publishableKey:t,fetcher:n=fetch})=>({name:"gateway",async export(r){let o={publishableKey:t,events:r};await n(`${e.replace(/\/$/,"")}/v1/traces`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${t}`},body:JSON.stringify(o)});}});var Yt=e=>new Promise(t=>setTimeout(t,e)),re=({url:e,fetcher:t=fetch,maxRetries:n=2,queueLimit:r=500})=>({name:"webhook",async export(o){let s=[...Qt(e),...o].slice(-r),a=0;for(;;){let l=await t(e,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({events:s})});if(l.ok){rt(e,[]);return}if(a>=n)throw rt(e,s),new Error(`Webhook exporter failed with status ${l.status}.`);a+=1,await Yt(100*a);}}}),ne=e=>`agtx:webhook:${e}`,Qt=e=>{if(typeof window>"u"||!window.localStorage)return [];try{let t=window.localStorage.getItem(ne(e));return t?JSON.parse(t):[]}catch{return []}},rt=(e,t)=>{if(!(typeof window>"u"||!window.localStorage))try{if(t.length===0){window.localStorage.removeItem(ne(e));return}window.localStorage.setItem(ne(e),JSON.stringify(t));}catch{}};var it="https://gateway.agentronics.dev",tn=e=>{if(e===void 0)return it;if(e===it)return e;let t;try{t=new URL(e);}catch{throw new Error(`Agentronics SDK: \`gatewayUrl\` is not a valid URL: ${e}`)}if(t.hostname==="localhost"||t.hostname==="127.0.0.1")return e;throw new Error(`Agentronics SDK does not support custom gateway URLs. Omit \`gatewayUrl\` to use the canonical https://gateway.agentronics.dev. The only accepted override is a localhost / 127.0.0.1 URL for local development. Got: ${e}`)},nn=e=>{let{publishableKey:t,siteId:n="default",debug:r=false,policies:o=[],trace:i={}}=e,s=tn(e.gatewayUrl),a=protocol.classifyApiKey(t);if(a==="secret")throw new protocol.AgentronicsError("wrong_key_kind","A secret key was passed to Agentronics.init(). Browser code must use a publishable key (agtx_pk_*).");if(a!=="publishable")throw new protocol.AgentronicsError("invalid_api_key",`Agentronics.init() expected a key starting with "${protocol.PUBLISHABLE_KEY_PREFIX}".`);let l=i.enabled??true,d=[...r?[ee()]:[],...i.gateway?[te({gatewayUrl:s,publishableKey:t})]:[],...i.webhookUrl?[re({url:i.webhookUrl})]:[],...i.exporters??[]],p={siteId:n,exporters:l?d:[],onExporterError:(c,y)=>{r&&console.warn(`[agentronics] trace exporter "${y.name}" failed`,c);}};i.bufferSize!==void 0&&(p.bufferSize=i.bufferSize),i.traceRate!==void 0&&(p.traceRate=i.traceRate),i.errorRate!==void 0&&(p.errorRate=i.errorRate),i.scrubPaths!==void 0&&(p.scrubPaths=i.scrubPaths);let g=Z(p),u=c=>{l&&g.emit(c);},f=le(),w={onTrace:u};e.auth!==void 0&&(w.context=e.auth);let m=Te(w),h=Se(),v=Pe(o),A=Re({gatewayUrl:s,siteId:n,publishableKey:t}),k=Ge({onTrace:u}),M={onTrace:u};e.siteMemory!==void 0&&(M.initial=e.siteMemory);let T=Be(M),I=_e({gatewayUrl:s,siteId:n,publishableKey:t}),W=async c=>{let y=Date.now(),x=await ce(c),b=f.preferOver(x);return l&&await g.emit({type:b?"agent.detected":"agent.missed",agent:b,durationMs:Date.now()-y,metadata:{detectedClass:x?.class??null,presented:f.snapshot()!==null}}),h.set(b,"detect"),b},oe=async(c,y={})=>{let x=Date.now(),b=y.identity!==void 0?y.identity:await W(),B=v.evaluate({tool:c,identity:b});return l&&await g.emit({type:"authz.evaluated",tool:c,agent:b,policy:B,outcome:B.decision==="deny"?"blocked":"success",durationMs:Date.now()-x}),B},P=Ke({evaluate:oe,setPolicies:c=>v.set(c),listPolicies:()=>v.list(),onTrace:u});for(let c of e.tools??[])P.register(c);let R=e.progression?ze(e.progression,{onTrace:u}):null,ie=c=>{let y={identity:c};return R&&(y.stage=R.current(),y.enabledStages=R.enabledStages()),y},E=c=>qe(P.list(),ie(c)),se=c=>{if(!R)return;R.notify(c).changed&&G.publish(E(null));},G=et({invoke:async(c,y)=>{let x=await P.execute(c.name,y,null);return se(c.name),x}});return Object.freeze({publishableKey:t,siteId:n,gatewayUrl:s,debug:r,memory:k,siteMemory:T,memoryCache:I,tracer:g,auth:m,agentContext:h,authz:v,policyCache:A,tools:P,progression:R,webmcp:G,detect:W,authenticate:async c=>{let y=await m.authenticate(c);return h.set(y,"authenticate"),y},presentIdentity:c=>{let y=f.present(c);return u({type:"auth.identity_presented",agent:y.identity,metadata:{vendor:y.identity.vendor,class:y.identity.class}}),h.set(y.identity,"declare"),y},clearIdentity:()=>{f.clear(),u({type:"auth.identity_cleared"}),h.set(null,"cleared");},presentedIdentity:()=>f.snapshot(),setPolicies:c=>{v.set(c),u({type:"authz.policies_set",metadata:{count:c.length}});},listPolicies:()=>v.list(),syncPolicies:async()=>{let c=await A.sync();return v.set(c.policies),u({type:"authz.policies_set",metadata:{count:c.policies.length,synced:true}}),c.policies},syncSiteMemory:async()=>{let c=await I.sync();return c.memory&&(T.replace(c.memory),u({type:"memory.updated",metadata:{kind:"site",operation:"sync",etag:c.etag}})),c.memory},provideSiteMemory:c=>T.provide(c),provideForPage:c=>{T.provideForPage(c);},installMemoryDelivery:({metaTags:c=true,overlay:y=false}={})=>{let x=[];return c&&x.push(F({snapshot:T.snapshot()})),y&&x.push(K({snapshot:T.snapshot()})),{uninstall:()=>{x.forEach(b=>b.uninstall());}}},fetchWellKnown:async c=>{let y={};c!==void 0&&(y.origin=c);let x=await z(y);return x&&(T.replace(x),u({type:"memory.updated",metadata:{kind:"site",operation:"wellKnown",origin:c??null}})),x},installDomEnforcer:()=>Ce({policyEngine:v,getIdentity:()=>W({webmcp:{pollMs:0}})}),registerTool:c=>P.register(c),surfaceTools:({identity:c=null}={})=>E(c),explainSurfacing:({identity:c=null}={})=>Xe(P.list(),ie(c)),groupedTools:({identity:c=null}={})=>Ye(E(c)),estimateTokens:({identity:c=null}={})=>Qe(E(c)),publishToWebMcp:({identity:c=null}={})=>{let y=E(c),x=G.publish(y);return y.forEach(b=>{u({type:"tool.surfaced",tool:b.name,metadata:{state:"published",trust:c?.trust??null,group:b.group??null}});}),{revoked:x.revoked,surfaced:y.length}},notifyToolInvoked:c=>se(c),evaluate:oe,traces:()=>g.list(),clearTraces:()=>g.clear(),async ping(){try{let c=await fetch(`${s.replace(/\/$/,"")}/v1/health`,{method:"GET",headers:{authorization:`Bearer ${t}`}});if(!c.ok)return {ok:!1,status:c.status,error:`gateway returned ${c.status}`};let y=await c.json().catch(()=>null)??{};return {ok:!0,status:c.status,body:y}}catch(c){return {ok:false,status:0,error:c instanceof Error?c.message:String(c)}}}})};
-exports.init=nn;//# sourceMappingURL=init-only.cjs.map
+`,Fe=e=>{let t=e.siteMap?.pages?.length??0,n=Object.keys(e.workflows).length,r=Object.keys(e.uiGuidance).length;return `Agentronics site memory \xB7 pages:${t} \xB7 workflows:${n} \xB7 ui-hints:${r}`},J=({doc:e=typeof document>"u"?null:document,snapshot:t,hidden:n=false})=>{if(!e)return {uninstall:()=>{},refresh:()=>{}};let r=e.getElementById(ze);return r||(r=e.createElement("div"),r.id=ze,r.setAttribute("role","note"),r.setAttribute("aria-label","Agentronics site memory summary"),r.setAttribute("data-agent-context","overlay"),e.body.appendChild(r)),r.setAttribute("style",Ft(n)),r.textContent=Fe(t),{uninstall:()=>{r?.remove();},refresh:o=>{r&&(r.textContent=Fe(o));}}};var Je="/.well-known/agent-context.json",q=async({origin:e,fetcher:t=fetch,signal:n}={})=>{let r=(e?e.replace(/\/$/,""):typeof window<"u"?window.location.origin:"")+Je;if(!r.startsWith("http"))return null;let o={headers:{accept:"application/json"}};n!==void 0&&(o.signal=n);let a=await t(r,o);if(!a.ok){if(a.status===404)return null;throw new Error(`well-known agent-context fetch failed with status ${a.status}.`)}let s=await a.json();return protocol.SiteMemory.parse(s)};var qe=({evaluate:e,setPolicies:t,listPolicies:n,onTrace:r,identityResolver:o})=>{let a=new Map,s=new Set,y=i=>{if(!i.authz||!t||!n)return;let g={id:`tool:${i.name}`,tool:i.name,...i.authz,rateLimit:i.rateLimit??i.authz.rateLimit};t([...n().filter(u=>u.id!==g.id),g]);};return {register(i){return a.set(i.name,i),s.delete(i.name),y(i),r?.({type:"tool.registered",tool:i.name,metadata:{version:i.version??null,group:i.group??null,stage:i.stage??null}}),()=>{a.delete(i.name),s.delete(i.name);}},unregister(i){a.delete(i),s.delete(i);},enable(i){!a.has(i)||!s.has(i)||(s.delete(i),r?.({type:"tool.surfaced",tool:i,metadata:{state:"enabled"}}));},disable(i){!a.has(i)||s.has(i)||(s.add(i),r?.({type:"tool.surfaced",tool:i,metadata:{state:"disabled"}}));},isEnabled:i=>a.has(i)&&!s.has(i),list({includeDisabled:i=false}={}){let g=[...a.values()];return i?g:g.filter(u=>!s.has(u.name))},get:i=>a.get(i),async execute(i,g,u){let d=u===void 0?o?.()??null:u,p=a.get(i);if(!p)throw new Error(`Tool "${i}" is not registered.`);if(s.has(i)){let l={decision:"deny",ruleId:`tool:${i}`,reason:"Tool is disabled."};throw r?.({type:"tool.executed",tool:i,agent:d,policy:l,outcome:"blocked"}),new Error(l.reason)}let h=await e(i,{identity:d});if(h.decision==="deny")throw r?.({type:"tool.executed",tool:i,agent:d,policy:h,outcome:"blocked"}),new Error(h.reason);let w=Date.now();try{let l=await p.execute(g,{identity:d});return r?.({type:"tool.executed",tool:i,agent:d,policy:h,outcome:"success",durationMs:Date.now()-w}),l}catch(l){throw r?.({type:"tool.executed",tool:i,agent:d,policy:h,outcome:"error",durationMs:Date.now()-w,error:l instanceof Error?l.message:String(l)}),l}}}};var qt=e=>{let t={name:e.name,description:e.description??"",inputSchema:e.inputSchema??{},tokens:0};return e.group&&(t.group=e.group),e.stage&&(t.page=e.stage),e.outputSchema&&(t.outputSchema=e.outputSchema),t.tokens=Math.ceil(JSON.stringify({name:t.name,description:t.description,inputSchema:t.inputSchema,...t.outputSchema?{outputSchema:t.outputSchema}:{}}).length/4),t},Xe=({gatewayUrl:e,siteId:t,publishableKey:n,fetcher:r=fetch})=>({async push(o){let a=o.map(qt),s=await r(`${e.replace(/\/$/,"")}/v1/sites/${encodeURIComponent(t)}/tools`,{method:"PUT",headers:{authorization:`Bearer ${n}`,"content-type":"application/json"},body:JSON.stringify({registry:{tools:a}})});if(!s.ok)throw new Error(`Tool sync failed with status ${s.status}.`);return a.length}});var Ye=(e,t={})=>{let n=new Map;for(let s of e.stages)n.set(s.name,s);if(!n.has(e.initial))throw new Error(`Initial stage "${e.initial}" is not declared in progression stages.`);let r=e.initial,o=()=>{let s=n.get(r);return s?.enables?[r,...s.enables]:[r]},a=(s,y)=>{let i=r;if(!n.has(s))throw new Error(`Cannot transition to unknown stage "${s}".`);return s===r?{changed:false,from:i,to:s}:(r=s,t.onTrace?.({type:"tool.progressed",metadata:{from:i,to:s,trigger:y}}),{changed:true,from:i,to:s})};return {current:()=>r,enabledStages:()=>o(),notify(s){let i=n.get(r)?.transitions?.find(g=>g.on===s);return i?a(i.to,s):{changed:false,from:r,to:r}},set(s){return a(s,"manual")},reset(){let s=r;r=e.initial,s!==r&&t.onTrace?.({type:"tool.progressed",metadata:{from:s,to:r,trigger:"reset"}});},snapshot:()=>({current:r,enabled:o()})}};var Xt=(e,t)=>{let n=e.authz?.minTrust;return n?t?protocol.TRUST_RANK[t.trust]<protocol.TRUST_RANK[n]?{ok:false,reason:`trust-too-low:${t.trust}<${n}`}:{ok:true,reason:"trust-ok"}:{ok:false,reason:`requires-trust:${n}`}:{ok:true,reason:"no-trust-floor"}},Yt=(e,t)=>{let n=e.authz?.allowedClasses??[];return n.length===0?{ok:true,reason:"no-class-restriction"}:t?n.includes(t.class)?{ok:true,reason:"class-ok"}:{ok:false,reason:`class-not-allowed:${t.class}`}:{ok:false,reason:`requires-class:${n.join("|")}`}},Qt=(e,t)=>e.stage?t.enabledStages&&t.enabledStages.includes(e.stage)?{ok:true,reason:`stage-enabled:${e.stage}`}:t.stage===e.stage?{ok:true,reason:`stage-active:${e.stage}`}:{ok:false,reason:`stage-locked:${e.stage}`}:{ok:true,reason:"no-stage"},Ze=(e,t)=>{let n=Xt(e,t.identity);if(!n.ok)return {tool:e,visible:false,reason:n.reason};let r=Yt(e,t.identity);if(!r.ok)return {tool:e,visible:false,reason:r.reason};let o=Qt(e,t);return o.ok?e.authz?.decision==="deny"?{tool:e,visible:false,reason:"authz-deny"}:{tool:e,visible:true,reason:"visible"}:{tool:e,visible:false,reason:o.reason}},et=(e,t)=>e.filter(n=>Ze(n,t).visible),tt=(e,t)=>e.map(n=>Ze(n,t));var Zt="default",nt=e=>{let t=new Map;for(let n of e){let r=n.group??Zt,o=t.get(r)??[];o.push(n),t.set(r,o);}return [...t.entries()].sort(([n],[r])=>n.localeCompare(r)).map(([n,r])=>({name:n,tools:r}))};var X=e=>e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(X).join(",")}]`:`{${Object.keys(e).sort().map(n=>`${JSON.stringify(n)}:${X(e[n])}`).join(",")}}`,en=e=>{let t={name:e.name,version:e.version??null,group:e.group??null,description:e.description??null,inputSchema:e.inputSchema??null,authz:e.authz??null,rateLimit:e.rateLimit??null},n=X(t).length;return {name:e.name,characters:n,tokens:Math.ceil(n/4)}},rt=e=>{let t=e.map(en);return {total:t.reduce((r,o)=>r+o.tokens,0),perTool:t}};var ot=e=>{if(e.provider)return e.provider;let n=(e.doc?.defaultView??(typeof globalThis<"u"?globalThis:null))?.navigator?.modelContext;return !n||typeof n.provideContext!="function"?null:n},tn=(e,t)=>{let n={name:e.name,invoke:r=>t(e,r)};return e.description!==void 0&&(n.description=e.description),e.inputSchema!==void 0&&(n.inputSchema=e.inputSchema),n},it=(e={})=>{let t=e.invoke??(async(r,o)=>r.execute(o,{identity:null})),n=null;return {publish(r){let o=ot(e);return o?(n?.revoke(),n=o.provideContext({tools:r.map(a=>tn(a,t))}),{revoked:true}):{revoked:false}},revoke(){n?.revoke(),n=null;},available:()=>!!ot(e)}};var Y=(e=500)=>{let t=[];return {add(n){t.push(n),t.length>e&&t.splice(0,t.length-e);},list(){return [...t]},clear(){t.length=0;}}};var st=(e,t)=>e===void 0?t:Math.max(0,Math.min(1,e)),Q=(e={})=>{let t=st(e.traceRate,1),n=st(e.errorRate,1),r=e.random??Math.random;return {shouldKeep(o){let a=o.outcome==="error"?n:t;return r()<a}}};var nn="[REDACTED]",rn=e=>{if(e!==void 0)return JSON.parse(JSON.stringify(e))},Z=(e,t)=>{if(t.length===0||typeof e!="object"||e===null)return;let[n,...r]=t;if(!n)return;if(Array.isArray(e)){for(let a of e)Z(a,t);return}let o=e;if(n in o){if(r.length===0){o[n]=nn;return}Z(o[n],r);}},ee=(e,t=[])=>{if(t.length===0)return e;let n=rn(e);for(let r of t)Z(n,r.split(".").filter(Boolean));return n},te=["metadata.password","metadata.token","metadata.authorization","metadata.cookie"];var sn=()=>typeof location<"u"&&typeof location.pathname=="string"?location.pathname:void 0,at=e=>{let t=globalThis.crypto;return t&&"randomUUID"in t?`${e}_${t.randomUUID()}`:`${e}_${Date.now().toString(36)}_${Math.random().toString(36).slice(2)}`},ne=({siteId:e,bufferSize:t,sessionId:n=at("ses"),scrubPaths:r=te,exporters:o=[],onExporterError:a,pageProvider:s=sn,...y})=>{let i=Y(t),g=Q(y),u=()=>{try{return s()}catch{return}};return {sessionId:n,async emit(d){let p={...d.metadata};if(p.page===void 0){let w=u();w!==void 0&&(p.page=w);}let h=protocol.TraceEvent.parse(ee({id:at("trc"),siteId:e,sessionId:n,occurredAt:new Date().toISOString(),outcome:d.outcome??"success",...d,metadata:p},r));return g.shouldKeep(h)?(i.add(h),await Promise.all(o.map(async w=>{try{await w.export([h]);}catch(l){a?.(l,w,h);}})),h):null},list:()=>i.list(),clear:()=>i.clear()}};var re=()=>({name:"console",export(e){for(let t of e)console.info("[agentronics:trace]",t.type,t);}});var oe=({gatewayUrl:e,publishableKey:t,fetcher:n=fetch})=>({name:"gateway",async export(r){let o={publishableKey:t,events:r};await n(`${e.replace(/\/$/,"")}/v1/traces`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${t}`},body:JSON.stringify(o)});}});var an=e=>new Promise(t=>setTimeout(t,e)),se=({url:e,fetcher:t=fetch,maxRetries:n=2,queueLimit:r=500})=>({name:"webhook",async export(o){let s=[...cn(e),...o].slice(-r),y=0;for(;;){let i=await t(e,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({events:s})});if(i.ok){ct(e,[]);return}if(y>=n)throw ct(e,s),new Error(`Webhook exporter failed with status ${i.status}.`);y+=1,await an(100*y);}}}),ie=e=>`agtx:webhook:${e}`,cn=e=>{if(typeof window>"u"||!window.localStorage)return [];try{let t=window.localStorage.getItem(ie(e));return t?JSON.parse(t):[]}catch{return []}},ct=(e,t)=>{if(!(typeof window>"u"||!window.localStorage))try{if(t.length===0){window.localStorage.removeItem(ie(e));return}window.localStorage.setItem(ie(e),JSON.stringify(t));}catch{}};var ut="https://gateway.agentronics.dev",pn=e=>{if(e===void 0)return ut;if(e===ut)return e;let t;try{t=new URL(e);}catch{throw new Error(`Agentronics SDK: \`gatewayUrl\` is not a valid URL: ${e}`)}if(t.hostname==="localhost"||t.hostname==="127.0.0.1")return e;throw new Error(`Agentronics SDK does not support custom gateway URLs. Omit \`gatewayUrl\` to use the canonical https://gateway.agentronics.dev. The only accepted override is a localhost / 127.0.0.1 URL for local development. Got: ${e}`)},dn=e=>{let{publishableKey:t,siteId:n="default",debug:r=false,policies:o=[],trace:a={}}=e,s=pn(e.gatewayUrl),y=protocol.classifyApiKey(t);if(y==="secret")throw new protocol.AgentronicsError("wrong_key_kind","A secret key was passed to Agentronics.init(). Browser code must use a publishable key (agtx_pk_*).");if(y!=="publishable")throw new protocol.AgentronicsError("invalid_api_key",`Agentronics.init() expected a key starting with "${protocol.PUBLISHABLE_KEY_PREFIX}".`);let i=a.enabled??true,g=[...r?[re()]:[],...a.gateway?[oe({gatewayUrl:s,publishableKey:t})]:[],...a.webhookUrl?[se({url:a.webhookUrl})]:[],...a.exporters??[]],u={siteId:n,exporters:i?g:[],onExporterError:(c,m)=>{r&&console.warn(`[agentronics] trace exporter "${m.name}" failed`,c);}};a.bufferSize!==void 0&&(u.bufferSize=a.bufferSize),a.traceRate!==void 0&&(u.traceRate=a.traceRate),a.errorRate!==void 0&&(u.errorRate=a.errorRate),a.scrubPaths!==void 0&&(u.scrubPaths=a.scrubPaths);let d=ne(u),p=c=>{i&&d.emit(c);},h=me(),w={onTrace:p};e.auth!==void 0&&(w.context=e.auth);let l=Ie(w),v=Me(),x=Oe(o),k=De({gatewayUrl:s,siteId:n,publishableKey:t}),I=Ue({onTrace:p}),R={onTrace:p};e.siteMemory!==void 0&&(R.initial=e.siteMemory);let T=Ke(R),P=Ve({gatewayUrl:s,siteId:n,publishableKey:t}),pt=Xe({gatewayUrl:s,siteId:n,publishableKey:t}),W=async c=>{let m=Date.now(),S=await de(c),b=h.preferOver(S);return i&&await d.emit({type:b?"agent.detected":"agent.missed",agent:b,durationMs:Date.now()-m,metadata:{detectedClass:S?.class??null,presented:h.snapshot()!==null}}),v.set(b,"detect"),b},ae=async(c,m={})=>{let S=Date.now(),b=m.identity!==void 0?m.identity:await W(),U=x.evaluate({tool:c,identity:b});return i&&await d.emit({type:"authz.evaluated",tool:c,agent:b,policy:U,outcome:U.decision==="deny"?"blocked":"success",durationMs:Date.now()-S}),U},M=qe({evaluate:ae,setPolicies:c=>x.set(c),listPolicies:()=>x.list(),onTrace:p,identityResolver:()=>v.snapshot().identity});for(let c of e.tools??[])M.register(c);let E=e.progression?Ye(e.progression,{onTrace:p}):null,ce=c=>{let m={identity:c};return E&&(m.stage=E.current(),m.enabledStages=E.enabledStages()),m},C=c=>et(M.list(),ce(c)),le=c=>{if(!E)return;E.notify(c).changed&&O.publish(C(v.snapshot().identity));},dt={class:"webmcp",trust:"detected",confidence:1,vendor:null,userAgent:typeof navigator<"u"?navigator.userAgent:null,detectionVersion:f,signals:{source:"navigator.modelContext"}},O=it({invoke:async(c,m)=>{let S=v.snapshot().identity??dt,b=await M.execute(c.name,m,S);return le(c.name),b}});v.subscribe(c=>{O.available()&&O.publish(C(c.identity));});let _=e.autoDetect??true,mt=_===false?Promise.resolve(null):(async()=>{let c=_===true?{}:_;try{return await W(c)}catch(m){return r&&console.warn("[agentronics] autoDetect failed:",m),null}})();return Object.freeze({publishableKey:t,siteId:n,gatewayUrl:s,debug:r,memory:I,siteMemory:T,memoryCache:P,tracer:d,auth:l,agentContext:v,authz:x,policyCache:k,tools:M,progression:E,webmcp:O,ready:mt,detect:W,authenticate:async c=>{let m=await l.authenticate(c);return v.set(m,"authenticate"),m},presentIdentity:c=>{let m=h.present(c);return p({type:"auth.identity_presented",agent:m.identity,metadata:{vendor:m.identity.vendor,class:m.identity.class}}),v.set(m.identity,"declare"),m},clearIdentity:()=>{h.clear(),p({type:"auth.identity_cleared"}),v.set(null,"cleared");},presentedIdentity:()=>h.snapshot(),setPolicies:c=>{x.set(c),p({type:"authz.policies_set",metadata:{count:c.length}});},listPolicies:()=>x.list(),syncPolicies:async()=>{let c=await k.sync();return x.set(c.policies),p({type:"authz.policies_set",metadata:{count:c.policies.length,synced:true}}),c.policies},syncSiteMemory:async()=>{let c=await P.sync();return c.memory&&(T.replace(c.memory),p({type:"memory.updated",metadata:{kind:"site",operation:"sync",etag:c.etag}})),c.memory},provideSiteMemory:c=>T.provide(c),provideForPage:c=>{T.provideForPage(c);},installMemoryDelivery:({metaTags:c=true,overlay:m=false}={})=>{let S=[];return c&&S.push(F({snapshot:T.snapshot()})),m&&S.push(J({snapshot:T.snapshot()})),{uninstall:()=>{S.forEach(b=>b.uninstall());}}},fetchWellKnown:async c=>{let m={};c!==void 0&&(m.origin=c);let S=await q(m);return S&&(T.replace(S),p({type:"memory.updated",metadata:{kind:"site",operation:"wellKnown",origin:c??null}})),S},installDomEnforcer:()=>$e({policyEngine:x,getIdentity:()=>W({webmcp:{pollMs:0}})}),registerTool:c=>M.register(c),syncTools:async()=>{let c=M.list({includeDisabled:true}),m=await pt.push(c);return p({type:"tool.registered",metadata:{operation:"sync",count:m}}),m},surfaceTools:({identity:c=null}={})=>C(c),explainSurfacing:({identity:c=null}={})=>tt(M.list(),ce(c)),groupedTools:({identity:c=null}={})=>nt(C(c)),estimateTokens:({identity:c=null}={})=>rt(C(c)),publishToWebMcp:({identity:c=null}={})=>{let m=C(c),S=O.publish(m);return m.forEach(b=>{p({type:"tool.surfaced",tool:b.name,metadata:{state:"published",trust:c?.trust??null,group:b.group??null}});}),{revoked:S.revoked,surfaced:m.length}},notifyToolInvoked:c=>le(c),evaluate:ae,traces:()=>d.list(),clearTraces:()=>d.clear(),async ping(){try{let c=await fetch(`${s.replace(/\/$/,"")}/v1/health`,{method:"GET",headers:{authorization:`Bearer ${t}`}});if(!c.ok)return {ok:!1,status:c.status,error:`gateway returned ${c.status}`};let m=await c.json().catch(()=>null)??{};return {ok:!0,status:c.status,body:m}}catch(c){return {ok:false,status:0,error:c instanceof Error?c.message:String(c)}}}})};
+exports.init=dn;//# sourceMappingURL=init-only.cjs.map
 //# sourceMappingURL=init-only.cjs.map